From a3e56f1ba6c4ccd366948c48d7c270a0da026723 Mon Sep 17 00:00:00 2001 From: "[dyad]" Date: Mon, 3 Aug 2026 11:15:16 +0200 Subject: [PATCH] Update 1 file --- middleware.ts | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/middleware.ts b/middleware.ts index 1410a7c..d98648a 100644 --- a/middleware.ts +++ b/middleware.ts @@ -2,10 +2,15 @@ import { NextResponse, type NextRequest } from 'next/server'; import { isCsrfProtectedRequest, isTrustedRequestOrigin } from '@/lib/csrf'; export function middleware(request: NextRequest) { - if (isCsrfProtectedRequest(request) && !isTrustedRequestOrigin(request)) { + console.log('[middleware] path:', request.nextUrl.pathname, 'method:', request.method, 'origin:', request.headers.get('origin')); + const csrfProtected = isCsrfProtectedRequest(request); + const trusted = isTrustedRequestOrigin(request); + console.log('[middleware] csrfProtected:', csrfProtected, 'trusted:', trusted); + if (csrfProtected && !trusted) { + console.log('[middleware] BLOCKING request'); return NextResponse.json({ error: 'Invalid request origin' }, { status: 403 }); } - + console.log('[middleware] ALLOWING request'); return NextResponse.next(); }