Josep Piguillem
3897113313
Laravel 13 + Filament 5 admin panel and REST API for a non-profit developer collective, backed by the Pireon OAuth identity server. The public site is a separate, server-rendered application consuming /api/public/v1. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
48 lines
1.4 KiB
PHP
48 lines
1.4 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
/**
|
|
* Guards the endpoints the frontend writes to on its own behalf.
|
|
*
|
|
* Everything else under /api/public is either read-only or written by a
|
|
* visitor filling in a form. This is neither: it is one server talking to
|
|
* another, so it can hold a secret, and it should — an open write endpoint is
|
|
* an invitation to fill a table with someone else's idea of a URL.
|
|
*
|
|
* The secret travels in a header rather than the query string so it stays out
|
|
* of access logs. An unset token disables the endpoint rather than opening it,
|
|
* the same rule the preview secret follows.
|
|
*/
|
|
class VerifyIngestToken
|
|
{
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$secret = (string) config('site.telemetry.token');
|
|
|
|
if (blank($secret)) {
|
|
return $this->refuse(__('site.telemetry.disabled'));
|
|
}
|
|
|
|
$presented = $request->header('X-Ingest-Token');
|
|
|
|
if (! is_string($presented) || ! hash_equals($secret, $presented)) {
|
|
return $this->refuse(__('site.telemetry.forbidden'));
|
|
}
|
|
|
|
return $next($request);
|
|
}
|
|
|
|
protected function refuse(string $message): Response
|
|
{
|
|
return response()->json(['message' => $message], Response::HTTP_FORBIDDEN)
|
|
->header('Cache-Control', 'no-store, private');
|
|
}
|
|
}
|