fix: gate admin routes against cross-origin CSRF

2026-05-18 13:21:01 +02:00
parent b299a0b602
commit c2eb2c081b
16 changed files with 82 additions and 39 deletions
@@ -19,9 +19,9 @@ import {
 * Returns current consent + endpoint + next/last send + a live preview
 * of exactly what the next heartbeat would contain.
 */
-export async function GET() {
+export async function GET(request: NextRequest) {
  try {
-    const auth = await requireAdminAuth();
+    const auth = await requireAdminAuth(request);
    if ('error' in auth) return auth.error;

    const { consent, source, state } = await effectiveConsent();
@@ -61,7 +61,7 @@ export async function GET() {
 */
 export async function POST(request: NextRequest) {
  try {
-    const auth = await requireAdminAuth();
+    const auth = await requireAdminAuth(request);
    if ('error' in auth) return auth.error;
    const ip = getClientIP(request);