fix: gate admin routes against cross-origin CSRF

2026-05-18 13:21:01 +02:00
parent b299a0b602
commit c2eb2c081b
16 changed files with 82 additions and 39 deletions
@@ -9,7 +9,7 @@ import { logger } from '@/lib/logger';
 */
 export async function POST(request: NextRequest) {
  try {
-    const result = await requireAdminAuth();
+    const result = await requireAdminAuth(request);
    if ('error' in result) return result.error;

    const ip = getClientIP(request);