ops: don't allow no origin

2026-08-28 08:56:58 +00:00 · 2024-11-24 18:14:50 -05:00
parent 39c7df9bb5
commit df42d433c9
1 changed files with 6 additions and 0 deletions
@@ -359,6 +359,12 @@ class WebServerService extends BaseService {
                    req.connection?.remoteAddress,
            };
            await svc_event.emit('ip.validate', event);
+
+            // check if no origin
+            if ( req.method === 'POST' && req.headers.origin === undefined ) {
+                event.allow = false;
+            }
+
            if ( ! event.allow ) {
                return res.status(403).send('Forbidden');
            }