Perfect_Python500/MineGeo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Harden request origin checks and configure allowed hosts

Browse Source
This commit is contained in:
perfect_python500
2026-10-04 17:00:02 +05:00
parent 5289c17adf
commit 04cc4f39f6
6 changed files with 319 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/auth/callback/route.ts
View File

@@ -1,12 +1,13 @@
import { NextRequest, NextResponse } from "next/server";
import { authClient } from "@/lib/supabase";
import { requestOrigin } from "@/lib/request-origin";
export async function GET(request: NextRequest) {
const origin = requestOrigin(request, process.env.MINEGEO_URL);
const code = request.nextUrl.searchParams.get("code");
if (code) {
const client = await authClient();
const { error } = await client.auth.exchangeCodeForSession(code);
if (!error)
return NextResponse.redirect(new URL("/dashboard", request.url));
if (!error) return NextResponse.redirect(new URL("/dashboard", origin));
}
return NextResponse.redirect(new URL("/dashboard?auth=failed", request.url));
return NextResponse.redirect(new URL("/dashboard?auth=failed", origin));
}