From df0294c75483e572a8c16d61760f207e9b97349f Mon Sep 17 00:00:00 2001
From: FernandoJVideira <03.pleaser-minster@icloud.com>
Date: Fri, 1 Aug 2025 01:49:54 +0100
Subject: [PATCH] Block Direct Requests

---
 middleware.go | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/middleware.go b/middleware.go
index fe6d091..cbcce3f 100644
--- a/middleware.go
+++ b/middleware.go
@@ -21,27 +21,27 @@ func RateLimiter(rps float64, burst int) func(http.Handler) http.Handler {
 	}
 }
 
-func RefererCheck(allowedDomains []string) func(http.Handler) http.Handler {
+func RefererCheck(allowedOrigins []string) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			referer := r.Header.Get("Referer")
 
-			// Allow requests with no referer (direct API calls, Postman, etc.)
+			// Block requests with no referer (this blocks direct browser requests)
 			if referer == "" {
-				next.ServeHTTP(w, r)
+				http.Error(w, "Forbidden!", http.StatusForbidden)
 				return
 			}
 
-			// Check if referer matches allowed domains
-			for _, domain := range allowedDomains {
-				if strings.HasPrefix(referer, domain) {
+			// Check if referer matches allowed origins
+			for _, origin := range allowedOrigins {
+				if strings.HasPrefix(referer, origin) {
 					next.ServeHTTP(w, r)
 					return
 				}
 			}
 
-			// Block if referer doesn't match
-			http.Error(w, "Forbidden", http.StatusForbidden)
+			// Block if referer doesn't match any allowed origin
+			http.Error(w, "Forbidden!", http.StatusForbidden)
 		})
 	}
 }