trade/trade-drift-dlob
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add internal auth bypass to new endpoints

Browse Source
This commit is contained in:
Nick Caradonna
2025-05-28 14:29:25 -04:00
parent ff5f2e7e30
commit 0594c3811c
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/index.ts
View File

@@ -788,7 +788,12 @@ const main = async (): Promise<void> => {
const origin = req.get('Origin') || req.get('Referer');
const allowedOrigins = ['https://app.drift.trade', 'https://beta.drift.trade'];
if (!origin || !allowedOrigins.some(allowed => origin.startsWith(allowed))) {
const hasAuth = (
(req.headers.Authorization || req.headers.authorization) ===
process.env.INTERNAL_SECRET
)
if (!hasAuth && (!origin || !allowedOrigins.some(allowed => origin.startsWith(allowed)))) {
res.status(403).json({ error: 'Forbidden: Invalid origin' });
return;
}
@@ -843,9 +848,14 @@ const main = async (): Promise<void> => {
try {
// Check origin validation
const origin = req.get('Origin') || req.get('Referer');
const allowedOrigins = ['https://app.drift.trade', 'https://beta.drift.trade'];
const allowedOrigins = ['https://app.drift.trade', 'https://beta.drift.trade'];
if (!origin || !allowedOrigins.some(allowed => origin.startsWith(allowed))) {
const hasAuth = (
(req.headers.Authorization || req.headers.authorization) ===
process.env.INTERNAL_SECRET
)
if (!hasAuth && (!origin || !allowedOrigins.some(allowed => origin.startsWith(allowed)))) {
res.status(403).json({ error: 'Forbidden: Invalid origin' });
return;
}