Referer logging Check

middleware.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"log"
 	"net/http"
 	"strings"
 
@@ -25,23 +26,33 @@ func RefererCheck(allowedOrigins []string) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			referer := r.Header.Get("Referer")
+			origin := r.Header.Get("Origin")
 
-			// Block requests with no referer (this blocks direct browser requests)
+			// Debug logging
-			if referer == "" {
+			log.Printf("RefererCheck - Referer: '%s', Origin: '%s', AllowedOrigins: %+v", referer, origin, allowedOrigins)
-				http.Error(w, "Forbidden!", http.StatusForbidden)
+			log.Printf("Request headers: %+v", r.Header)
-				return
-			}
 
-			// Check if referer matches allowed origins
+			// Check both Referer and Origin headers
-			for _, origin := range allowedOrigins {
+			if referer != "" {
-				if strings.HasPrefix(referer, origin) {
+				for _, allowedOrigin := range allowedOrigins {
-					next.ServeHTTP(w, r)
+					if strings.HasPrefix(referer, strings.TrimSuffix(allowedOrigin, "/")) {
-					return
+						next.ServeHTTP(w, r)
+						return
+					}
 				}
 			}
 
-			// Block if referer doesn't match any allowed origin
+			if origin != "" {
-			http.Error(w, "Forbidden!", http.StatusForbidden)
+				for _, allowedOrigin := range allowedOrigins {
+					if origin == strings.TrimSuffix(allowedOrigin, "/") {
+						next.ServeHTTP(w, r)
+						return
+					}
+				}
+			}
+
+			log.Printf("RefererCheck - BLOCKED: No valid referer or origin found")
+			http.Error(w, "Forbidden", http.StatusForbidden)
 		})
 	}
 }