Block Direct Requests

API_DOCS.md

@@ -9,7 +9,7 @@ http://localhost:8080/v1
 ## Fantasy Name Endpoints
 
 | Race/Type    | Endpoint                    | Query Parameters |
-|-------------------|----------------------------------|---------------------------|
+| ------------ | --------------------------- | ---------------- | ------ | ------- |
 | Elf          | /fantasy/elf-names          | gender=male      | female | child   |
 | Dwarf        | /fantasy/dwarf-names        | gender=male      | female |
 | Arakocra     | /fantasy/arakocra-names     | -                |
@@ -65,7 +65,7 @@ http://localhost:8080/v1
 ## Modern Name Endpoints
 
 | Language/Type          | Endpoint           | Query Parameters |
-|----------------------|-----------------------------|---------------------------|
+| ---------------------- | ------------------ | ---------------- | ------ | ------ |
 | Modern English         | /modern/english    | gender=male      | female | unisex |
 | Modern Portuguese (EU) | /modern/portuguese | gender=male      | female | unisex |
 

main.go

@@ -23,13 +23,14 @@ func main() {
 
 	r.Use(cors.Handler(cors.Options{
 		//AllowedOrigins: []string{"https://*", "http://*"}, //* Use this for development
-		AllowedOrigins:   GetEnvList("ALLOWED_ORIGINS", []string{"https://lk-api-temp.onrender.com"}), //* Use this for production
+		AllowedOrigins:   GetEnvList("ALLOWED_ORIGINS", []string{"https://utils.fernandovideira.com"}), //* Use this for production
 		AllowedMethods:   []string{"GET"},
 		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
 		ExposedHeaders:   []string{"Link"},
 		AllowCredentials: false,
 		MaxAge:           300,
 	}))
+	r.Use(RefererCheck(GetEnvList("ALLOWED_ORIGINS", []string{"https://utils.fernandovideira.com"})))
 	r.Use(RateLimiter(rps, burst))
 
 	r.Route("/v1", func(r chi.Router) {

middleware.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"net/http"
+	"strings"
 
 	"golang.org/x/time/rate"
 )
@@ -19,3 +20,28 @@ func RateLimiter(rps float64, burst int) func(http.Handler) http.Handler {
 		})
 	}
 }
+
+func RefererCheck(allowedDomains []string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			referer := r.Header.Get("Referer")
+
+			// Allow requests with no referer (direct API calls, Postman, etc.)
+			if referer == "" {
+				next.ServeHTTP(w, r)
+				return
+			}
+
+			// Check if referer matches allowed domains
+			for _, domain := range allowedDomains {
+				if strings.HasPrefix(referer, domain) {
+					next.ServeHTTP(w, r)
+					return
+				}
+			}
+
+			// Block if referer doesn't match
+			http.Error(w, "Forbidden", http.StatusForbidden)
+		})
+	}
+}