From e0bd9295c7946f3c93c3c06b80511ad630844e43 Mon Sep 17 00:00:00 2001
From: FernandoJVideira <03.pleaser-minster@icloud.com>
Date: Fri, 1 Aug 2025 02:08:59 +0100
Subject: [PATCH] Referer logging Check

---
 middleware.go | 35 +++++++++++++++++++++++------------
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/middleware.go b/middleware.go
index cbcce3f..929742e 100644
--- a/middleware.go
+++ b/middleware.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"log"
 	"net/http"
 	"strings"
 
@@ -25,23 +26,33 @@ func RefererCheck(allowedOrigins []string) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			referer := r.Header.Get("Referer")
+			origin := r.Header.Get("Origin")
 
-			// Block requests with no referer (this blocks direct browser requests)
-			if referer == "" {
-				http.Error(w, "Forbidden!", http.StatusForbidden)
-				return
-			}
+			// Debug logging
+			log.Printf("RefererCheck - Referer: '%s', Origin: '%s', AllowedOrigins: %+v", referer, origin, allowedOrigins)
+			log.Printf("Request headers: %+v", r.Header)
 
-			// Check if referer matches allowed origins
-			for _, origin := range allowedOrigins {
-				if strings.HasPrefix(referer, origin) {
-					next.ServeHTTP(w, r)
-					return
+			// Check both Referer and Origin headers
+			if referer != "" {
+				for _, allowedOrigin := range allowedOrigins {
+					if strings.HasPrefix(referer, strings.TrimSuffix(allowedOrigin, "/")) {
+						next.ServeHTTP(w, r)
+						return
+					}
 				}
 			}
 
-			// Block if referer doesn't match any allowed origin
-			http.Error(w, "Forbidden!", http.StatusForbidden)
+			if origin != "" {
+				for _, allowedOrigin := range allowedOrigins {
+					if origin == strings.TrimSuffix(allowedOrigin, "/") {
+						next.ServeHTTP(w, r)
+						return
+					}
+				}
+			}
+
+			log.Printf("RefererCheck - BLOCKED: No valid referer or origin found")
+			http.Error(w, "Forbidden", http.StatusForbidden)
 		})
 	}
 }