@xleddyl/nuxt-cms 0.1.37 → 0.1.38

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@xleddyl/nuxt-cms",
   "configKey": "cms",
-  "version": "0.1.37",
+  "version": "0.1.38",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/dist/runtime/server/routes/auth/login.post.js

@@ -2,6 +2,7 @@ import { createHash, timingSafeEqual } from "node:crypto";
 import { createError, defineEventHandler, getRequestIP, readValidatedBody } from "h3";
 import { z } from "zod";
 import { setUserSession, useRuntimeConfig, useStorage } from "#imports";
+import { assertSameOrigin } from "../../utils/require-admin.js";
 const credentialsSchema = z.object({
   email: z.string().trim().min(1),
   password: z.string().min(1)
@@ -47,6 +48,7 @@ function safeEqual(a, b) {
   return timingSafeEqual(hashA, hashB);
 }
 export default defineEventHandler(async (event) => {
+  assertSameOrigin(event);
   const ip = rateKey(getRequestIP(event, { xForwardedFor: true }) ?? "unknown");
   const now = Date.now();
   const [attempts, globalFailures] = await Promise.all([

package/dist/runtime/server/utils/require-admin.d.ts

@@ -1,2 +1,3 @@
 import type { H3Event } from 'h3';
+export declare function assertSameOrigin(event: H3Event): void;
 export declare function requireAdmin(event: H3Event): Promise<void>;

package/dist/runtime/server/utils/require-admin.js

@@ -1,17 +1,27 @@
 import { createError, getRequestHeader, getRequestHost } from "h3";
 import { getUserSession, useRuntimeConfig } from "#imports";
-function assertSameOrigin(event) {
-  const origin = getRequestHeader(event, "origin");
-  if (!origin) return;
-  let originHost;
+const ORIGINLESS_SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function hostOfUrl(value) {
+  if (!value) return void 0;
   try {
-    originHost = new URL(origin).host;
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:" ? url.host : void 0;
   } catch {
-    originHost = void 0;
+    return void 0;
   }
-  if (!originHost || originHost !== getRequestHost(event, { xForwardedHost: true })) {
-    throw createError({ statusCode: 403, statusMessage: "Cross-origin request rejected" });
+}
+function rejectCrossOrigin() {
+  throw createError({ statusCode: 403, statusMessage: "Cross-origin request rejected" });
+}
+export function assertSameOrigin(event) {
+  const expectedHost = getRequestHost(event);
+  const origin = getRequestHeader(event, "origin");
+  if (origin) {
+    if (hostOfUrl(origin) !== expectedHost) rejectCrossOrigin();
+    return;
   }
+  if (ORIGINLESS_SAFE_METHODS.has(event.method)) return;
+  if (hostOfUrl(getRequestHeader(event, "referer")) !== expectedHost) rejectCrossOrigin();
 }
 export async function requireAdmin(event) {
   assertSameOrigin(event);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xleddyl/nuxt-cms",
-  "version": "0.1.37",
+  "version": "0.1.38",
   "description": "Lightweight CMS that ships with your Nuxt app: runs on the Nitro server, content types defined in code, /cms admin panel, GraphQL API, SQLite or Postgres. No external CMS needed!",
   "license": "MIT",
   "author": "Edoardo Alberti (https://github.com/xleddyl)",