Block Direct Requests

middleware.go

@@ -21,27 +21,27 @@ func RateLimiter(rps float64, burst int) func(http.Handler) http.Handler {
 	}
 }
 
-func RefererCheck(allowedDomains []string) func(http.Handler) http.Handler {
+func RefererCheck(allowedOrigins []string) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			referer := r.Header.Get("Referer")
 
-			// Allow requests with no referer (direct API calls, Postman, etc.)
+			// Block requests with no referer (this blocks direct browser requests)
 			if referer == "" {
-				next.ServeHTTP(w, r)
+				http.Error(w, "Forbidden!", http.StatusForbidden)
 				return
 			}
 
-			// Check if referer matches allowed domains
-			for _, domain := range allowedDomains {
-				if strings.HasPrefix(referer, domain) {
+			// Check if referer matches allowed origins
+			for _, origin := range allowedOrigins {
+				if strings.HasPrefix(referer, origin) {
 					next.ServeHTTP(w, r)
 					return
 				}
 			}
 
-			// Block if referer doesn't match
-			http.Error(w, "Forbidden", http.StatusForbidden)
+			// Block if referer doesn't match any allowed origin
+			http.Error(w, "Forbidden!", http.StatusForbidden)
 		})
 	}
 }