first

src/servers/_middlewares/origin-validation.ts

@@ -0,0 +1,51 @@
+import type { MiddlewareHandler } from 'hono';
+import * as errors from '../custom-errors';
+
+const { PUBLIC_BUILD_ENV } = process.env;
+
+const ALLOWED_ORIGINS: Record<string, string[]> = {
+  staging: ['https://staging.officer.dev'],
+  production: ['https://app.officer.dev', 'https://edge.officer.dev'],
+};
+
+export function isOriginAllowed(origin: string | undefined, host?: string): boolean {
+  // Dev environment: allow any origin
+  if (!PUBLIC_BUILD_ENV || PUBLIC_BUILD_ENV === 'dev' || PUBLIC_BUILD_ENV === 'development') {
+    return true;
+  }
+
+  // If origin is present, validate it
+  if (origin) {
+    // Chrome extension check
+    if (origin.startsWith('chrome-extension://')) {
+      if (PUBLIC_BUILD_ENV === 'staging') {
+        return true; // Allow any extension in staging
+      }
+      if (PUBLIC_BUILD_ENV === 'production') {
+        return origin === 'chrome-extension://fjooappefigppfjolhadliepialebodg';
+      }
+    }
+
+    // Web origin check
+    const allowed = ALLOWED_ORIGINS[PUBLIC_BUILD_ENV];
+    return !!allowed?.includes(origin);
+  }
+
+  // No origin header: allow same-origin requests by checking Host header
+  // This handles cases where browsers don't send Origin for same-origin requests
+  if (host) {
+    const allowed = ALLOWED_ORIGINS[PUBLIC_BUILD_ENV];
+    return !!allowed?.some((o) => o.endsWith(host));
+  }
+
+  return false;
+}
+
+export const originValidationMiddleware: MiddlewareHandler = function (ctx, next) {
+  const origin = ctx.get('origin') as string | undefined;
+  const host = ctx.req.header('host');
+  if (!isOriginAllowed(origin, host)) {
+    throw errors.FORBIDDEN('Invalid origin');
+  }
+  return next();
+};