Disable post request for other domains except frontend domain

generator1013 years ago

7

• 

  notchr3 years ago

  I think you're right in setting up CORS, but the requests don't originate from a page with an URL so CORS does not apply with Postman IIRC.

• 

  jacobsfletch

  3 years ago

  Can you read

  req.origin

  from access control hooks and whitelist only certain domains?

• 

  jarrod_not_jared

  3 years ago

  This page might be useful to you as well:

  https://payloadcms.com/docs/production/preventing-abuse
• 

  generator1013 years ago

  @808734492645785600

  by access control hooks you mean these hooks?

  https://payloadcms.com/docs/hooks/collections
  
  @281120856527077378

  thank you, yeah, I read that last night, I am planning to also implement recaptcha but that would be next step

  
  
  @808734492645785600

  oh I see what you mean, so something like this on create

  
  
  

  create: ({ req }) => {
    console.log(req.hostname)
    // if it is my domain set it to true
    return true
  },

  
  
  

  looks like we dont have

  req.origin

  https://expressjs.com/en/api.html#req

  , there is a

  req.hostname

  but this always returns the backend part

• 

  jarrod_not_jared

  3 years ago

  what about

  https://expressjs.com/en/api.html#req.originalUrl
• 

  generator1013 years ago

  yeah that returns the api route but doesnt include the frontend domain

  
  
  

  Okay, here is what I did in case someone else need to implement something similar.

  
  

  I created a new API route in next.js

  /api/submission

  to send my post submissions and where I send the post request to Payload and included a secret key in the header

  
  
  

  method: ‘POST’,
  headers: {
      ‘Content-Type’: ‘application/json’,
      secret: `${process.env.PAYLOAD_SUBMISSION_SECRET}`,
  },
  ...

  
  
  

  In the server side, I get that secret key and compare it before creating a post:

  
  
  

  create: ({ req }) => {
   if (req.user) return true
   if (
     req.headers.secret === process.env.PAYLOAD_SUBMISSION_SECRET
   ) return true
  },

  
  
  

  This way if anyone sends a post requests, they are blocked unless it is coming from front end or if they add that secret code but because using next.js api route, abusers would not see the header has a secret key!

  
  
  

  and once again, I just love Payload !

  
  
  https://tenor.com/view/love-you-so-much-gif-25114698
• 

  jarrod_not_jared

  3 years ago

  Great idea!