denshooter
0349c686fa
feat(api): require session authentication for admin routes and improve error handling fix(api): streamline project image generation by fetching data directly from the database fix(api): optimize project import/export functionality with session validation and improved error handling fix(api): enhance analytics dashboard and email manager with session token for admin requests fix(components): improve loading states and dynamic imports for better user experience chore(security): update Content Security Policy to avoid unsafe-eval in production chore(deps): update package.json scripts for consistent environment handling in linting and testing
51 lines
1.6 KiB
TypeScript
51 lines
1.6 KiB
TypeScript
import { NextRequest, NextResponse } from 'next/server';
|
|
import { verifySessionToken } from '@/lib/auth';
|
|
|
|
export async function POST(request: NextRequest) {
|
|
try {
|
|
const { sessionToken, csrfToken } = await request.json();
|
|
|
|
if (!sessionToken) {
|
|
return new NextResponse(
|
|
JSON.stringify({ valid: false, error: 'No session token provided' }),
|
|
{ status: 400, headers: { 'Content-Type': 'application/json' } }
|
|
);
|
|
}
|
|
|
|
// CSRF Protection
|
|
const expectedCSRF = request.headers.get('x-csrf-token');
|
|
if (!csrfToken || !expectedCSRF || csrfToken !== expectedCSRF) {
|
|
return new NextResponse(
|
|
JSON.stringify({ valid: false, error: 'CSRF token validation failed' }),
|
|
{ status: 403, headers: { 'Content-Type': 'application/json' } }
|
|
);
|
|
}
|
|
|
|
const valid = verifySessionToken(request, sessionToken);
|
|
if (!valid) {
|
|
return new NextResponse(
|
|
JSON.stringify({ valid: false, error: 'Session expired or invalid' }),
|
|
{ status: 401, headers: { 'Content-Type': 'application/json' } }
|
|
);
|
|
}
|
|
|
|
return new NextResponse(
|
|
JSON.stringify({ valid: true, message: 'Session valid' }),
|
|
{
|
|
status: 200,
|
|
headers: {
|
|
'Content-Type': 'application/json',
|
|
'X-Content-Type-Options': 'nosniff',
|
|
'X-Frame-Options': 'DENY',
|
|
'X-XSS-Protection': '1; mode=block'
|
|
}
|
|
}
|
|
);
|
|
} catch {
|
|
return new NextResponse(
|
|
JSON.stringify({ valid: false, error: 'Internal server error' }),
|
|
{ status: 500, headers: { 'Content-Type': 'application/json' } }
|
|
);
|
|
}
|
|
}
|