Block Direct Requests

middleware.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"net/http"
+	"strings"
 
 	"golang.org/x/time/rate"
 )
@@ -19,3 +20,28 @@ func RateLimiter(rps float64, burst int) func(http.Handler) http.Handler {
 		})
 	}
 }
+
+func RefererCheck(allowedDomains []string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			referer := r.Header.Get("Referer")
+
+			// Allow requests with no referer (direct API calls, Postman, etc.)
+			if referer == "" {
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			// Check if referer matches allowed domains
+			for _, domain := range allowedDomains {
+				if strings.HasPrefix(referer, domain) {
+					next.ServeHTTP(w, r)
+					return
+				}
+			}
+
+			// Block if referer doesn't match
+			http.Error(w, "Forbidden", http.StatusForbidden)
+		})
+	}
+}