@@ -57,7 +57,23 @@ export const ALLOWED_ORIGINS = getAllowedOrigins();
57
57
* Used to verify requests are coming from our frontend
58
58
*/
59
59
export function generateRequestToken ( req ) {
60
- const baseString = `${ req . headers [ "user-agent" ] } :${ req . headers [ "host" ] } :connect-demo` ;
60
+ // Try to use x-forwarded-host or origin's hostname instead of host to handle domain mapping
61
+ // This handles the case where the request goes through a reverse proxy or domain mapping
62
+ let effectiveHost = req . headers [ "host" ] ;
63
+
64
+ // If there's an origin header, extract its hostname
65
+ // as it will match the client's window.location.host
66
+ if ( req . headers . origin ) {
67
+ try {
68
+ const originUrl = new URL ( req . headers . origin ) ;
69
+ effectiveHost = originUrl . host ;
70
+ } catch ( e ) {
71
+ // Fall back to host header if origin parsing fails
72
+ console . log ( "Error parsing origin:" , e . message ) ;
73
+ }
74
+ }
75
+
76
+ const baseString = `${ req . headers [ "user-agent" ] } :${ effectiveHost } :connect-demo` ;
61
77
return Buffer . from ( baseString ) . toString ( "base64" ) ;
62
78
}
63
79
@@ -130,36 +146,6 @@ export function validateRequest(req, res, allowedMethod) {
130
146
// Request token validation to prevent API automation
131
147
const expectedToken = generateRequestToken ( req ) ;
132
148
133
- // Debug logging to diagnose token validation issues
134
- console . log ( "Request headers:" , {
135
- host : req . headers . host ,
136
- origin : req . headers . origin ,
137
- referer : req . headers . referer ,
138
- // Truncate user-agent to avoid huge logs
139
- userAgent : req . headers [ "user-agent" ] ?. substring ( 0 , 50 ) + "..." ,
140
- } ) ;
141
-
142
- // Log token information
143
- console . log ( "Token comparison:" , {
144
- received : requestToken ,
145
- expected : expectedToken ,
146
- matches : requestToken === expectedToken ,
147
- } ) ;
148
-
149
- // If there's a mismatch, decode both tokens to see what's different
150
- if ( requestToken !== expectedToken ) {
151
- try {
152
- const decodedReceived = Buffer . from ( requestToken , "base64" ) . toString ( ) ;
153
- const decodedExpected = Buffer . from ( expectedToken , "base64" ) . toString ( ) ;
154
- console . log ( "Decoded tokens:" , {
155
- received : decodedReceived ,
156
- expected : decodedExpected ,
157
- } ) ;
158
- } catch ( e ) {
159
- console . log ( "Error decoding tokens:" , e . message ) ;
160
- }
161
- }
162
-
163
149
if ( ! requestToken || requestToken !== expectedToken ) {
164
150
return res . status ( 403 ) . json ( {
165
151
error : "Access denied" ,
0 commit comments