treamz/wa-dev-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security: lock down API — only landing endpoints public

Browse Source 
- Only /api/settings, /api/tools, /api/content/advantages|dashboard public
- All other /api/* require authentication (401)
- Moved API mount after auth middleware, public endpoints before
This commit is contained in:
treamz 2026-03-22 00:28:32 +03:00
parent 3353253cef
commit 6ac3366ea9
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
lib/auth.js
View File

@ -4,12 +4,14 @@
*/
const PUBLIC_PATHS = ['/', '/health', '/favicon.ico'];
const PUBLIC_PREFIXES = ['/auth/', '/vendor/', '/placeholder-img/', '/api/', '/admin'];
const PUBLIC_API = ['/api/settings', '/api/tools', '/api/content/advantages', '/api/content/dashboard'];
const PUBLIC_PREFIXES = ['/auth/', '/vendor/', '/placeholder-img/', '/admin'];
const PUBLIC_FILES = ['/shared.css', '/shared.js', '/landing.html'];
function authMiddleware(req, res, next) {
// Public paths
if (PUBLIC_PATHS.includes(req.path)) return next();
if (PUBLIC_API.includes(req.path)) return next();
if (PUBLIC_FILES.includes(req.path)) return next();
if (PUBLIC_PREFIXES.some(p => req.path.startsWith(p))) return next();

11
server.js
View File

@ -22,12 +22,19 @@ app.use(express.static('public'));
// Auth routes (before auth middleware — public)
app.use('/auth', require('./routes/auth'));
// Public API (settings, tools, content — for landing page)
app.use('/api', require('./routes/api'));
// Public API (only specific endpoints for landing page)
const apiRouter = require('./routes/api');
app.get('/api/settings', apiRouter);
app.get('/api/tools', apiRouter);
app.get('/api/content/advantages', apiRouter);
app.get('/api/content/dashboard', apiRouter);
// Auth middleware (protects everything below)
app.use(authMiddleware);
// Protected API (all other /api/* routes)
app.use('/api', apiRouter);
// Health check (extended)
const startTime = Date.now();
app.get('/health', (req, res) => {