bdd3019214
Adds checkSameOrigin() helper in auth.ts that validates the Origin header against the Host header. If Origin is present and mismatched, returns 403. Applied to all 5 custom POST routes flagged in CPM-003 (NEXT-CSRF-001): - change-password, link-oauth-start, unlink-oauth, update-avatar, logout SameSite=Lax (NextAuth default) already blocks standard cross-site CSRF; this adds defense-in-depth against subdomain and misconfiguration scenarios. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
11 lines
327 B
TypeScript
11 lines
327 B
TypeScript
import { NextRequest } from "next/server";
|
|
import { signOut, checkSameOrigin } from "@/src/lib/auth";
|
|
|
|
export const dynamic = 'force-dynamic';
|
|
|
|
export async function POST(request: NextRequest) {
|
|
const originCheck = checkSameOrigin(request);
|
|
if (originCheck) return originCheck;
|
|
await signOut({ redirectTo: "/login" });
|
|
}
|