Creationshop/cannaiq
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(auth): Add *.cannabrands.app to trusted origins whitelist

Browse Source 
Adds pattern-based origin matching to support wildcard subdomains.
All *.cannabrands.app origins now bypass API key authentication.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
Kelly
2025-12-09 12:06:14 -07:00
parent be4221af46
commit f418c403d6
1 changed files with 27 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
backend/src/auth/middleware.ts
View File

@@ -29,6 +29,11 @@ const TRUSTED_ORIGINS = [
'http://localhost:5173', 'http://localhost:5173',
]; ];
// Pattern-based trusted origins (wildcards)
const TRUSTED_ORIGIN_PATTERNS = [
/^https:\/\/.*\.cannabrands\.app$/, // *.cannabrands.app
];
// Trusted IPs for internal pod-to-pod communication // Trusted IPs for internal pod-to-pod communication
const TRUSTED_IPS = [ const TRUSTED_IPS = [
'127.0.0.1', '127.0.0.1',
@@ -42,9 +47,17 @@ const TRUSTED_IPS = [
function isTrustedRequest(req: Request): boolean { function isTrustedRequest(req: Request): boolean {
// Check origin header // Check origin header
const origin = req.headers.origin; const origin = req.headers.origin;
if (origin && TRUSTED_ORIGINS.includes(origin)) { if (origin) {
if (TRUSTED_ORIGINS.includes(origin)) {
return true; return true;
} }
// Check pattern-based origins (wildcards like *.cannabrands.app)
for (const pattern of TRUSTED_ORIGIN_PATTERNS) {
if (pattern.test(origin)) {
return true;
}
}
}
// Check referer header (for same-origin requests without CORS) // Check referer header (for same-origin requests without CORS)
const referer = req.headers.referer; const referer = req.headers.referer;
@@ -54,6 +67,18 @@ function isTrustedRequest(req: Request): boolean {
return true; return true;
} }
} }
// Check pattern-based referers
try {
const refererUrl = new URL(referer);
const refererOrigin = refererUrl.origin;
for (const pattern of TRUSTED_ORIGIN_PATTERNS) {
if (pattern.test(refererOrigin)) {
return true;
}
}
} catch {
// Invalid referer URL, skip
}
} }
// Check IP for internal requests (pod-to-pod, localhost) // Check IP for internal requests (pod-to-pod, localhost)