photo-editor/src/http/middleware/origin-check.js

"use strict";

const { ForbiddenError } = require("../../errors");

/**
 * Middleware проверки Origin для защиты от CSRF на state-changing запросах.
 */
function originCheck() {
  return (req, res, next) => {
    // Only check state-changing methods
    const method = req.method.toUpperCase();
    if (["GET", "HEAD", "OPTIONS"].includes(method)) {
      return next();
    }

    const origin = req.headers.origin;
    if (!origin) {
      return next();
    }

    try {
      const originUrl = new URL(origin);
      const hostHeader = (req.headers.host || "").toLowerCase();

      // Compare host (including port if present)
      if (originUrl.host.toLowerCase() !== hostHeader) {
        return next(
          new ForbiddenError(
            `Запрос с внешнего источника (${originUrl.host}) заблокирован.`
          )
        );
      }

      next();
    } catch {
      return next(new ForbiddenError("Некорректный заголовок Origin."));
    }
  };
}

module.exports = {
  originCheck,
};