csrf token and browser detection

1 files changed, 47 insertions, 0 deletions

diff --git a/apps/web/src/app/api/waitlist/token/route.ts b/apps/web/src/app/api/waitlist/token/route.ts
new file mode 100644
index 00000000..76622fc5
--- /dev/null
+++ b/apps/web/src/app/api/waitlist/token/route.ts
@@ -0,0 +1,47 @@
+import { NextRequest, NextResponse } from "next/server";
+import { cookies } from "next/headers";
+import crypto from "crypto";
+import { env } from "@/env";
+
+const CSRF_TOKEN_NAME = "waitlist-csrf";
+const TOKEN_EXPIRY = 60 * 60 * 1000;
+
+export async function GET(request: NextRequest) {
+  const referer = request.headers.get("referer");
+  const host = request.headers.get("host");
+
+  if (referer) {
+    const refererUrl = new URL(referer);
+    const allowedHosts = env.NODE_ENV === "development" ? ["localhost:3000", "127.0.0.1:3000"] : ["opencut.app", "www.opencut.app"];
+
+    if (!allowedHosts.some((allowed) => refererUrl.host === allowed || refererUrl.host.endsWith(allowed))) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+  } else if (host) {
+    const allowedHosts = env.NODE_ENV === "development" ? ["localhost:3000", "127.0.0.1:3000"] : ["opencut.app", "www.opencut.app"];
+
+    if (!allowedHosts.some((allowed) => host === allowed || host.endsWith(allowed))) {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+    }
+  } else {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
+  }
+
+  const token = crypto.randomBytes(32).toString("hex");
+  const timestamp = Date.now();
+  const signature = crypto
+    .createHmac("sha256", env.BETTER_AUTH_SECRET || "fallback-secret")
+    .update(`${token}:${timestamp}`)
+    .digest("hex");
+
+  const cookieStore = await cookies();
+  cookieStore.set(CSRF_TOKEN_NAME, `${token}:${timestamp}:${signature}`, {
+    httpOnly: true,
+    secure: env.NODE_ENV === "production",
+    sameSite: "strict",
+    maxAge: TOKEN_EXPIRY / 1000,
+    path: "/",
+  });
+
+  return NextResponse.json({ token });
+}