diff options
| author | Jakob L. Kreuze <zerodaysfordays@sdf.org> | 2023-08-12 14:39:19 -0400 |
|---|---|---|
| committer | Jakob L. Kreuze <zerodaysfordays@sdf.org> | 2023-08-12 14:44:46 -0400 |
| commit | 7ac00aa9d10a31540d5d09c8035d64bbc76a6002 (patch) | |
| tree | 9ae17ab2068cd25617250fafee7b8ae682ef2519 | |
| parent | 93e53c7f24084096c0b6347a96cc31e30c954933 (diff) | |
[api] Disallow Tor/i2p access to certain API endpoints
| -rw-r--r-- | haunt/api.scm | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/haunt/api.scm b/haunt/api.scm index de385dd..354e1b6 100644 --- a/haunt/api.scm +++ b/haunt/api.scm @@ -52,6 +52,15 @@ ((values-list exp) (call-with-values (lambda () exp) list)))) +(define (clearnet-only handler) + (lambda (request body) + (let ((originating-ip (assoc-ref (request-headers request) 'x-forwarded-for))) + (if (and (or (string-prefix? "127." originating-ip) + (string-suffix? ":1" originating-ip)) + (not (%debug-enabled))) + (panic "This API is only available on the clearnet." #:code 403) + (handler request body))))) + (define (handle-api-request request body endpoint) "Route handler for the API server." (let ((method (request-method request)) @@ -76,9 +85,9 @@ (('POST "api" "comment") put-comment) (('POST "api" "comment" "react") put-reaction) - (('GET "apps" "gallery") get-gallery) - (('GET "apps" "rsvp" "event-info") get-event-info) - (('POST "apps" "rsvp") post-event-rsvp) + (('GET "apps" "gallery") (clearnet-only get-gallery)) + (('GET "apps" "rsvp" "event-info") (clearnet-only get-event-info)) + (('POST "apps" "rsvp") (clearnet-only post-event-rsvp)) (_ (lambda (. args) (not-found request))))) request body)))))) |