Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Protects next.js proxy from unauthorized usage #2273

Open
wants to merge 4 commits into
base: testing
Choose a base branch
from
Open

Conversation

mohsinayoob
Copy link
Collaborator

@mohsinayoob mohsinayoob commented Jan 6, 2025

Summary

Fixes #QF-1552

Protects next.js proxy from unauthorized usage. For integration or client side it checks for the origin of the request and for server side it checks signature for each request.
New ENV Vars:

  • ALLOWED_ORIGINS=quran.com,test.quran.com
  • PROXY_SIGNATURE_TOKEN=123456

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • This change requires a documentation update

Test plan

This should state how this PR have been tested.

Checklist

  • My code follows the style guidelines of this project
  • I have performed a self-review of my code
  • My changes generate no new warnings
  • Any dependent changes have been merged and published in downstream modules
  • I have commented on my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes

Screenshots or videos

Before After
IMAGE HERE IMAGE HERE

Copy link

vercel bot commented Jan 6, 2025

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
quran-com ✅ Ready (Inspect) Visit Preview 💬 Add feedback Jan 15, 2025 11:28am

@mohsinayoob mohsinayoob requested a review from osamasayed January 6, 2025 17:18
@mohsinayoob mohsinayoob self-assigned this Jan 6, 2025
@mohsinayoob mohsinayoob changed the title Qf 1552 Protects next.js proxy from unauthorized usage Jan 7, 2025
@osamasayed osamasayed dismissed a stale review January 8, 2025 10:05

By mistake

src/pages/api/proxy/[...path].ts Outdated Show resolved Hide resolved
Copy link

@Mustafiz04 Mustafiz04 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes look good. Just to make sure nothing will break, have you tested thoroughly in local?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants