yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 17:46:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: centralize trusted same-origin validation for watch session and upload token routes

Browse Source
This commit is contained in:
Yusuf İpek
2026-02-23 18:31:09 +03:00
parent 1708c5c99c
commit 449433a08a
3 changed files with 67 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/watch/[videoId]/session/route.ts
+2 -1
View File
@@ -2,6 +2,7 @@ import { createHash } from 'crypto';
import { NextRequest, NextResponse } from 'next/server';
import { db } from '@/lib/db';
import { checkRateLimit, getClientIp, rateLimit, rateLimitHeaders } from '@/lib/rate-limit';
import { isTrustedSameOriginRequest } from '@/lib/request-origin';
import { MAX_SHARE_PASSWORD_LENGTH, validateShareLinkAccess } from '@/lib/share-links';
import {
createPendingShareValue,
@@ -38,7 +39,7 @@ function validateSameOriginRequest(request: NextRequest): NextResponse | null {
return NextResponse.json({ error: 'Missing Origin header' }, { status: 403 });
}
if (origin !== request.nextUrl.origin) {
if (!isTrustedSameOriginRequest(request)) {
return NextResponse.json({ error: 'Cross-origin requests are not allowed' }, { status: 403 });
}