remove browser check

1 files changed, 0 insertions, 109 deletions

diff --git a/apps/web/src/app/api/waitlist/route.ts b/apps/web/src/app/api/waitlist/route.ts
index 076dd228..f62e24e9 100644
--- a/apps/web/src/app/api/waitlist/route.ts
+++ b/apps/web/src/app/api/waitlist/route.ts
@@ -16,108 +16,6 @@ const waitlistSchema = z.object({
 const CSRF_TOKEN_NAME = "waitlist-csrf";

 const TOKEN_EXPIRY = 60 * 60 * 1000;

 

-function validateBrowserRequest(request: NextRequest): boolean {

-  const origin = request.headers.get("origin");

-  const referer = request.headers.get("referer");

-  const userAgent = request.headers.get("user-agent") || "";

-  const secFetchSite = request.headers.get("sec-fetch-site");

-  const secFetchMode = request.headers.get("sec-fetch-mode");

-  const secFetchDest = request.headers.get("sec-fetch-dest");

-  const contentType = request.headers.get("content-type");

-  const accept = request.headers.get("accept");

-

-  if (env.NODE_ENV === "development") {

-    console.log("=== Validating Browser Request ===");

-    console.log("Origin:", origin);

-    console.log("Referer:", referer);

-    console.log("User-Agent:", userAgent);

-    console.log("Sec-Fetch-Site:", secFetchSite);

-    console.log("Sec-Fetch-Mode:", secFetchMode);

-    console.log("Sec-Fetch-Dest:", secFetchDest);

-    console.log("Content-Type:", contentType);

-    console.log("Accept:", accept);

-  }

-

-  const allowedOrigins =

-    env.NODE_ENV === "development" ? ["http://localhost:3000", "http://127.0.0.1:3000"] : ["https://opencut.app", "https://www.opencut.app"];

-

-  if (!origin || !allowedOrigins.includes(origin)) {

-    console.log("Failed: Invalid origin");

-    return false;

-  }

-

-  if (!referer || !referer.startsWith(origin)) {

-    console.log("Failed: Invalid referer");

-    return false;

-  }

-

-  const suspiciousUserAgents = [

-    "curl",

-    "wget",

-    "postman",

-    "insomnia",

-    "thunder client",

-    "httpie",

-    "python-requests",

-    "node-fetch",

-    "axios",

-    "scrapy",

-    "httpclient",

-    "okhttp",

-    "libwww-perl",

-    "python-urllib",

-    "go-http-client",

-    "java/",

-    "apache-httpclient",

-  ];

-

-  const lowerUserAgent = userAgent.toLowerCase();

-  if (!userAgent || suspiciousUserAgents.some((agent) => lowerUserAgent.includes(agent))) {

-    console.log("Failed: Suspicious user agent");

-    return false;

-  }

-

-  const hasBrowserIndicators =

-    lowerUserAgent.includes("mozilla/") ||

-    lowerUserAgent.includes("chrome/") ||

-    lowerUserAgent.includes("safari/") ||

-    lowerUserAgent.includes("firefox/") ||

-    lowerUserAgent.includes("edge/");

-

-  if (!hasBrowserIndicators) {

-    console.log("Failed: No browser indicators in user agent");

-    return false;

-  }

-

-  if (secFetchSite && secFetchSite !== "same-origin") {

-    console.log("Failed: Invalid Sec-Fetch-Site:", secFetchSite);

-    return false;

-  }

-

-  if (secFetchMode && secFetchMode !== "cors") {

-    console.log("Failed: Invalid Sec-Fetch-Mode:", secFetchMode);

-    return false;

-  }

-

-  if (secFetchDest && secFetchDest !== "empty") {

-    console.log("Failed: Invalid Sec-Fetch-Dest:", secFetchDest);

-    return false;

-  }

-

-  if (!contentType || !contentType.includes("application/json")) {

-    console.log("Failed: Invalid Content-Type");

-    return false;

-  }

-

-  if (!accept || (!accept.includes("application/json") && !accept.includes("*/*"))) {

-    console.log("Failed: Invalid Accept header");

-    return false;

-  }

-

-  console.log("Browser validation passed!");

-  return true;

-}

-

 async function validateCSRFToken(request: NextRequest): Promise<boolean> {

   const clientToken = request.headers.get("x-csrf-token");

   if (!clientToken) return false;

@@ -153,13 +51,6 @@ export async function POST(request: NextRequest) {
   if (!success) {

     return NextResponse.json({ error: "Too many requests. Please try again later." }, { status: 429 });

   }

-

-  if (!validateBrowserRequest(request)) {

-    await new Promise((resolve) => setTimeout(resolve, Math.random() * 2000 + 1000));

-

-    return NextResponse.json({ error: "Invalid request" }, { status: 403 });

-  }

-

   const isValidToken = await validateCSRFToken(request);

   if (!isValidToken) {

     return NextResponse.json({ error: "Invalid security token" }, { status: 403 });