lthn/trade-frontend
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: ssrf

Browse source
This commit is contained in:
AzizbekFayziyev 2025-07-07 16:36:46 +05:00
parent 6d8b547eac
commit 8f29762c75
2 changed files with 15 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
.env.example
View file

@ -1 +1,2 @@
NEXT_PUBLIC_API_URL="backend url"
NEXT_PUBLIC_API_URL="backend url"
ALLOWED_HOST="example.com"

20
src/pages/_app.tsx
View file

@ -64,19 +64,25 @@ App.getInitialProps = async (context: AppContext) => {
if (!context.ctx.req) return pageProps;
const { host } = context.ctx.req.headers;
const configData = (await fetch(`http://${host}/api/config`).then((res) =>
res.json(),
)) as GetConfigRes;
const allowedHosts = ['trade.zano.org', 'localhost:3000', process.env.ALLOWED_HOST].filter(
Boolean,
);
if (!host || !allowedHosts.includes(host)) {
console.error(`Blocked request from disallowed host: ${host}`);
return pageProps;
}
const configData = (await fetch(`http://${host}/api/config`, {
credentials: 'include',
}).then((res) => res.json())) as GetConfigRes;
return {
...pageProps,
config: configData.data,
};
} catch (error) {
console.log(
`Unable to fetch config data from http://${context?.ctx?.req?.headers?.host}/api/config`,
);
console.log(error);
console.error('Unable to fetch config data:', error);
return NextApp.getInitialProps(context);
}