INNER CODE UNIT · JavaScript

guardOrigin

aeonfun/opendia · opendia-mcp/server.js:216

function guardOrigin(req, res, next) {
  const origin = req.headers.origin;
  if (!isAllowedOrigin(origin)) {
    console.error(`🚫 Rejected ${req.method} ${req.path} from origin ${origin}`);
    return res.status(403).json({ error: 'Forbidden' });
  }
  return next();
}

function timingSafeEqual(a, b) {
  const left = Buffer.from(a);
  const right = Buffer.from(b);
  return left.length === right.length && crypto.timingSafeEqual(left, right);
}

function requireToken(req, res, next) {
  if (!AUTH_TOKEN) return next();

View source record →