@@ -129,6 +129,37 @@ export function validateRequest(req, res, allowedMethod) {
129
129
130
130
// Request token validation to prevent API automation
131
131
const expectedToken = generateRequestToken ( req ) ;
132
+
133
+ // Debug logging to diagnose token validation issues
134
+ console . log ( "Request headers:" , {
135
+ host : req . headers . host ,
136
+ origin : req . headers . origin ,
137
+ referer : req . headers . referer ,
138
+ // Truncate user-agent to avoid huge logs
139
+ userAgent : req . headers [ "user-agent" ] ?. substring ( 0 , 50 ) + "..." ,
140
+ } ) ;
141
+
142
+ // Log token information
143
+ console . log ( "Token comparison:" , {
144
+ received : requestToken ,
145
+ expected : expectedToken ,
146
+ matches : requestToken === expectedToken ,
147
+ } ) ;
148
+
149
+ // If there's a mismatch, decode both tokens to see what's different
150
+ if ( requestToken !== expectedToken ) {
151
+ try {
152
+ const decodedReceived = Buffer . from ( requestToken , "base64" ) . toString ( ) ;
153
+ const decodedExpected = Buffer . from ( expectedToken , "base64" ) . toString ( ) ;
154
+ console . log ( "Decoded tokens:" , {
155
+ received : decodedReceived ,
156
+ expected : decodedExpected ,
157
+ } ) ;
158
+ } catch ( e ) {
159
+ console . log ( "Error decoding tokens:" , e . message ) ;
160
+ }
161
+ }
162
+
132
163
if ( ! requestToken || requestToken !== expectedToken ) {
133
164
return res . status ( 403 ) . json ( {
134
165
error : "Access denied" ,
0 commit comments