20260607 - login, add scene, add hotspot

backend/middlewares/authMiddleware.js

@@ -6,9 +6,14 @@ const User = require('../models/User');
  */
 const protect = async (req, res, next) => {
     let token;
-    if (req.headers.authorization && req.headers.authorization.startsWith('Bearer')) {
+    if (
+        (req.headers.authorization && req.headers.authorization.startsWith('Bearer')) ||
+        req.query.token
+    ) {
         try {
-            token = req.headers.authorization.split(' ')[1];
+            token = req.headers.authorization 
+                ? req.headers.authorization.split(' ')[1] 
+                : req.query.token;
             const decoded = jwt.verify(token, process.env.JWT_SECRET);
             req.user = await User.findById(decoded.id).select('-password');
             if (!req.user) {
@@ -28,9 +33,14 @@ const protect = async (req, res, next) => {
  * but allows the request to proceed as a guest if no token is found.
  */
 const optionalAuth = async (req, res, next) => {
-    if (req.headers.authorization && req.headers.authorization.startsWith('Bearer')) {
+    if (
+        (req.headers.authorization && req.headers.authorization.startsWith('Bearer')) ||
+        req.query.token
+    ) {
         try {
-            const token = req.headers.authorization.split(' ')[1];
+            const token = req.headers.authorization 
+                ? req.headers.authorization.split(' ')[1] 
+                : req.query.token;
             const decoded = jwt.verify(token, process.env.JWT_SECRET);
             req.user = await User.findById(decoded.id).select('-password');
         } catch (error) {

backend/middlewares/securityMiddleware.js

@@ -19,9 +19,16 @@ const verifyReferer = (req, res, next) => {
     const isMatch = (headerValue) => {
         if (!headerValue) return false;
         try {
-            return new URL(headerValue).origin === allowedOrigin;
+            const urlObj = new URL(headerValue);
+            const incomingOrigin = urlObj.origin;
+            // Cho phép nếu khớp hoàn toàn origin
+            if (incomingOrigin === allowedOrigin) return true;
+            // Trong môi trường development, cho phép localhost với bất kỳ port nào
+            const isLocal = incomingOrigin.includes('localhost') || incomingOrigin.includes('127.0.0.1') || incomingOrigin.includes('::1');
+            if (process.env.NODE_ENV !== 'production' && isLocal) return true;
+            return false;
         } catch (e) {
-            return headerValue.startsWith(allowedOrigin);
+            return false;
         }
     };