christianV/Craze-Data-check
1
0
Fork 0
mirror of https://github.com/christianvidalwolf-prog/Craze-Data-check.git synced 2026-08-03 12:15:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Security: Restrict API endpoints to allowed origin (CORS)

Browse Source 
Both Vercel serverless functions now enforce CORS, returning 403 for
requests from any origin other than craze-data-check.vercel.app.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Christian Vidal Wolf
2026-04-23 10:02:47 +02:00
co-authored by Claude Sonnet 4.6
parent dec24f52f4
commit 2e4ab35f37
2 changed files with 60 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/dropbox-proxy.js
+28 -12
View File
@@ -2,6 +2,18 @@ const DROPBOX_APP_KEY = process.env.DROPBOX_APP_KEY;
const DROPBOX_APP_SECRET = process.env.DROPBOX_APP_SECRET;
const DROPBOX_REFRESH_TOKEN = process.env.DROPBOX_REFRESH_TOKEN;
const ALLOWED_ORIGIN = 'https://craze-data-check.vercel.app';
function setCors(req, res) {
const origin = req.headers.origin;
if (origin === ALLOWED_ORIGIN) {
res.setHeader('Access-Control-Allow-Origin', ALLOWED_ORIGIN);
}
res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
res.setHeader('Vary', 'Origin');
}
async function getAccessToken() {
const response = await fetch('https://api.dropboxapi.com/oauth2/token', {
method: 'POST',
@@ -21,24 +33,28 @@ async function getAccessToken() {
}
export default async function handler(req, res) {
let accessToken;
setCors(req, res);
if (req.method === 'OPTIONS') {
return res.status(204).end();
}
const origin = req.headers.origin;
if (origin && origin !== ALLOWED_ORIGIN) {
return res.status(403).json({ error: 'Forbidden' });
}
try {
accessToken = await getAccessToken();
await getAccessToken();
} catch (err) {
console.warn('Token refresh optional failure (sharing link might still work):', err.message);
}
if (req.method === 'GET' && req.query.info === '1') {
try {
// In this mode, we'll just return a placeholder rev since we're using a sharing link now
// This satisfies the frontend check without needing a specific API path
res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
res.setHeader('Pragma', 'no-cache');
res.setHeader('Expires', '0');
return res.json({ rev: 'new-url-v1', size: 0, server_modified: new Date().toISOString() });
} catch (err) {
return res.status(500).json({ error: err.message });
}
res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
res.setHeader('Pragma', 'no-cache');
res.setHeader('Expires', '0');
return res.json({ rev: 'new-url-v1', size: 0, server_modified: new Date().toISOString() });
}
try {