71 lines
2.3 KiB
JavaScript
71 lines
2.3 KiB
JavaScript
const { URL } = require('url');
|
|
|
|
/**
|
|
* Anti-hotlinking middleware. Ensures that requests for assets originate
|
|
* from the official app domain (SYSTEM_HOST). Blocks direct URL access.
|
|
*/
|
|
const verifyReferer = (req, res, next) => {
|
|
// Cho phép các Bot của mạng xã hội truy cập để lấy ảnh thumbnail
|
|
const userAgent = req.headers['user-agent'] || '';
|
|
const isSocialBot = /facebookexternalhit|Facebot|ZaloBot|Twitterbot|Slackbot|LinkedInBot|Embedly/i.test(userAgent);
|
|
|
|
if (isSocialBot) {
|
|
return next();
|
|
}
|
|
|
|
const referer = req.headers.referer;
|
|
const origin = req.headers.origin;
|
|
const systemHost = process.env.SYSTEM_HOST || 'http://localhost:5000';
|
|
|
|
let allowedOrigin;
|
|
try {
|
|
allowedOrigin = new URL(systemHost).origin;
|
|
} catch (e) {
|
|
allowedOrigin = systemHost;
|
|
}
|
|
|
|
const isMatch = (headerValue) => {
|
|
if (!headerValue) return false;
|
|
try {
|
|
const urlObj = new URL(headerValue);
|
|
const incomingOrigin = urlObj.origin;
|
|
// Cho phép nếu khớp hoàn toàn origin
|
|
if (incomingOrigin === allowedOrigin) return true;
|
|
// Trong môi trường development, cho phép localhost với bất kỳ port nào
|
|
const isLocal = incomingOrigin.includes('localhost') || incomingOrigin.includes('127.0.0.1') || incomingOrigin.includes('::1');
|
|
if (process.env.NODE_ENV !== 'production' && isLocal) return true;
|
|
return false;
|
|
} catch (e) {
|
|
return false;
|
|
}
|
|
};
|
|
|
|
const hasValidReferer = isMatch(referer);
|
|
const hasValidOrigin = isMatch(origin);
|
|
|
|
// Block request if both referer and origin are missing or do not match SYSTEM_HOST
|
|
if (!hasValidReferer && !hasValidOrigin) {
|
|
return res.status(403).json({
|
|
message: 'Access denied: Hotlinking detected or direct file access is prohibited.'
|
|
});
|
|
}
|
|
|
|
next();
|
|
};
|
|
|
|
/**
|
|
* Cache prevention middleware. Ensures that sensitive image assets are never
|
|
* cached by client browsers or intermediate proxies.
|
|
*/
|
|
const setNoCacheHeaders = (req, res, next) => {
|
|
res.setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
|
|
res.setHeader('Pragma', 'no-cache');
|
|
res.setHeader('Expires', '0');
|
|
next();
|
|
};
|
|
|
|
module.exports = {
|
|
verifyReferer,
|
|
setNoCacheHeaders
|
|
};
|