bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-14 23:07:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(proxy): validate host against allowlist to prevent open redirect (fixes #65)

Browse source
This commit is contained in:
FuturMix 2026-06-14 12:20:57 +08:00
parent 8f4691584c
commit 876ccdae5f
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
apps/logicsrc-web/src/proxy.ts
View file

@ -4,12 +4,13 @@ import type { NextRequest } from "next/server";
// Canonical host: 301 www.* to the bare apex domain over https, preserving // Canonical host: 301 www.* to the bare apex domain over https, preserving
// path + query (e.g. https://www.logicsrc.com/foo -> https://logicsrc.com/foo). // path + query (e.g. https://www.logicsrc.com/foo -> https://logicsrc.com/foo).
// This is the Next 16 "proxy" (formerly middleware) entrypoint. // This is the Next 16 "proxy" (formerly middleware) entrypoint.
const ALLOWED_APEX = process.env.PUBLIC_DOMAIN || "logicsrc.com";
export function proxy(request: NextRequest): NextResponse { export function proxy(request: NextRequest): NextResponse {
const host = request.headers.get("host") ?? ""; const host = request.headers.get("host") ?? "";
if (host.startsWith("www.")) { if (host === `www.${ALLOWED_APEX}`) {
const apexHost = host.slice("www.".length);
const { pathname, search } = request.nextUrl; const { pathname, search } = request.nextUrl;
return NextResponse.redirect(`https://${apexHost}${pathname}${search}`, 301); return NextResponse.redirect(`https://${ALLOWED_APEX}${pathname}${search}`, 301);
} }
return NextResponse.next(); return NextResponse.next();
} }