file module import { AppConfig } from '@/app.config' ; import { Request , Response } from 'express' ; import { HttpStatus , Inject , Injectable , NestMiddleware } from '@nestjs/common' ; import { isProdMode } from '@/app.environment' ; class classdesc @ Injectable ( ) export class OriginMiddleware implements NestMiddleware { @ Inject ( ) appConfig : AppConfig ; use ( request , response , next ) { if ( isProdMode ) { const { origin , referer } = request . headers ; const checkHeader = ( field ) => ! field || field . includes ( this . appConfig . server . allowReferer ) ; const isVerifiedOrigin = checkHeader ( origin ) ; const isVerifiedReferer = checkHeader ( referer ) ; if ( ! isVerifiedOrigin && ! isVerifiedReferer ) { return response . status ( HttpStatus . UNAUTHORIZED ) . jsonp ( { code : HttpStatus . UNAUTHORIZED , message : 'Disallowed origin or referer' , } ) ; } } return next ( ) ; } }