Leon SerfatyandClaude Opus 5
8f90347659
Turnstile protected sign-in, sign-up and password-reset, but three gaps remained: - updatePassword had no verification and its page had no widget, so the final step of the reset flow was unprotected. The reset token is now carried through the failure redirect so a failed challenge doesn't strand the user on a form whose emailed link can't be replayed. - /api/auth/[...all] exposed better-auth's handler directly, accepting unlimited credential guesses and email sends with no bot protection -- a full bypass of the page-level checks. Credential-bearing POSTs now require a verified token. The gate lives in the route handler, so the server actions (which call auth.api.* in-process) are unaffected. GET is untouched for OAuth callbacks and verify-email links, and /sign-in/social stays open since it only redirects to the provider. - Turnstile tokens expire after ~5 minutes and the widget never reset, so a form left open submitted a stale token and failed with "complete the verification challenge" despite the challenge visibly passing. Verified with Cloudflare's test keys: all four auth forms block an invalid token, pass a valid one through to real auth logic, and the API gate returns 403 without a token and 401 with one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
67 lines
2.1 KiB
TypeScript
67 lines
2.1 KiB
TypeScript
import { NextResponse } from "next/server"
|
|
import { auth } from "@/lib/auth"
|
|
import { toNextJsHandler } from "better-auth/next-js"
|
|
import { verifyTurnstile } from "@/lib/turnstile"
|
|
|
|
const handlers = toNextJsHandler(auth)
|
|
|
|
// The auth pages post to server actions, which call `auth.api.*` in-process and
|
|
// run their own verifyTurnstile() check. This route is the *other* door into the
|
|
// same endpoints — a direct HTTP POST — and without this gate it accepts
|
|
// unlimited credential guesses and email sends with no bot protection at all.
|
|
//
|
|
// Only credential-bearing / email-triggering POSTs are gated. GET is untouched
|
|
// (OAuth callbacks, verify-email links, get-session), and `/sign-in/social` is
|
|
// left open because it only starts a redirect to the provider.
|
|
const CAPTCHA_PROTECTED = new Set([
|
|
"/sign-in/email",
|
|
"/sign-up/email",
|
|
"/request-password-reset",
|
|
"/reset-password",
|
|
"/send-verification-email",
|
|
])
|
|
|
|
/**
|
|
* Turnstile token from a header (preferred — leaves the body stream untouched)
|
|
* or, for clients that submit it inline, from a cloned JSON body.
|
|
*/
|
|
async function captchaToken(request: Request): Promise<string | null> {
|
|
const header =
|
|
request.headers.get("x-captcha-response") ??
|
|
request.headers.get("cf-turnstile-response")
|
|
if (header) return header
|
|
|
|
try {
|
|
const body = (await request.clone().json()) as Record<string, unknown>
|
|
const inline = body?.["cf-turnstile-response"] ?? body?.captchaToken
|
|
return typeof inline === "string" ? inline : null
|
|
} catch {
|
|
// Not JSON, or no body — treated as a missing token, which fails closed.
|
|
return null
|
|
}
|
|
}
|
|
|
|
export const GET = handlers.GET
|
|
|
|
export async function POST(request: Request) {
|
|
const path = new URL(request.url).pathname.replace(/^\/api\/auth/, "")
|
|
|
|
if (CAPTCHA_PROTECTED.has(path)) {
|
|
const ok = await verifyTurnstile(
|
|
await captchaToken(request),
|
|
request.headers.get("x-forwarded-for")
|
|
)
|
|
if (!ok) {
|
|
return NextResponse.json(
|
|
{
|
|
message: "Verification challenge required.",
|
|
code: "CAPTCHA_VERIFICATION_FAILED",
|
|
},
|
|
{ status: 403 }
|
|
)
|
|
}
|
|
}
|
|
|
|
return handlers.POST(request)
|
|
}
|