Fijxu/http3-ytproxy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

security: restrict the setting of CORS headers to inv.nadeko.net related domains
All checks were successful
CI / build (push) Successful in 5m12s
Details

Browse source 
security: restrict the setting of CORS headers to inv.nadeko.net related domains
This commit is contained in:
Fijxu 2024-11-12 09:23:30 -03:00
parent 89c880bb27
commit 939f4da3f7
Signed by: Fijxu
GPG key ID: 32C1DDF333EDA6A4
1 changed files with 16 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
main.go
View file

@ -321,16 +321,27 @@ func beforeProxy(next http.HandlerFunc) http.HandlerFunc {
return func(w http.ResponseWriter, req *http.Request) {
defer panicHandler(w)
w.Header().Set("Access-Control-Allow-Origin", "*")
w.Header().Set("Access-Control-Allow-Headers", "*")
w.Header().Set("Access-Control-Max-Age", "1728000")
// To prevent accessing from the bare IP address
if req.Host == "" || net.ParseIP(strings.Split(req.Host, ":")[0]) != nil {
w.WriteHeader(444)
return
}
// Only allow requests from origin inv.nadeko.net
// Why? Because I don't want anyone to use this proxy for their own purposes.
// Hardcoded because I'm lazy lol!
origin := req.URL.Query().Get("Origin")
if origin == "https://inv.nadeko.net" || origin == "https://materialious.nadeko.net" {
w.Header().Set("Access-Control-Allow-Origin", "*")
w.Header().Set("Access-Control-Allow-Headers", "*")
w.Header().Set("Access-Control-Allow-Methods", "GET, HEAD, OPTIONS")
w.Header().Set("Access-Control-Max-Age", "1728000")
} else {
w.WriteHeader(401)
io.WriteString(w, "Only requests coming from inv.nadeko.net are allowed.")
return
}
if h3s {
w.Header().Set("Alt-Svc", "h3=\":8443\"; ma=86400")
}
@ -341,6 +352,7 @@ func beforeProxy(next http.HandlerFunc) http.HandlerFunc {
}
if req.Method != "GET" && req.Method != "HEAD" {
w.WriteHeader(405)
io.WriteString(w, "Only GET and HEAD requests are allowed.")
return
}