afc6f5f3a8
- Add API key authentication middleware for all API endpoints - Fix path traversal vulnerability with screen parameter validation - Implement comprehensive input validation and sanitization - Create centralized security utilities in lib/security.ts - Add input validation for all stream and screen API endpoints - Prevent SQL injection with proper parameter validation - Add URL validation and string sanitization - Update documentation with security setup instructions - Pass all TypeScript type checks and ESLint validation Security improvements address critical vulnerabilities: - Authentication: Protect all API endpoints with API key - Path traversal: Validate screen names against allowlist - Input validation: Comprehensive validation with error details - XSS prevention: String sanitization and length limits 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
47 lines
No EOL
1.2 KiB
TypeScript
47 lines
No EOL
1.2 KiB
TypeScript
// API client utility for making authenticated requests
|
|
|
|
// Get API key from environment (client-side will need to be provided differently)
|
|
function getApiKey(): string | null {
|
|
if (typeof window === 'undefined') {
|
|
// Server-side
|
|
return process.env.API_KEY || null;
|
|
} else {
|
|
// Client-side - for now, return null to bypass auth in development
|
|
// In production, this would come from a secure storage or context
|
|
return null;
|
|
}
|
|
}
|
|
|
|
// Authenticated fetch wrapper
|
|
export async function apiCall(url: string, options: RequestInit = {}): Promise<Response> {
|
|
const apiKey = getApiKey();
|
|
|
|
const headers: Record<string, string> = {
|
|
'Content-Type': 'application/json',
|
|
...options.headers,
|
|
};
|
|
|
|
// Add API key if available
|
|
if (apiKey) {
|
|
headers['x-api-key'] = apiKey;
|
|
}
|
|
|
|
return fetch(url, {
|
|
...options,
|
|
headers,
|
|
});
|
|
}
|
|
|
|
// Convenience methods
|
|
export const apiClient = {
|
|
get: (url: string) => apiCall(url, { method: 'GET' }),
|
|
post: (url: string, data: unknown) => apiCall(url, {
|
|
method: 'POST',
|
|
body: JSON.stringify(data)
|
|
}),
|
|
put: (url: string, data: unknown) => apiCall(url, {
|
|
method: 'PUT',
|
|
body: JSON.stringify(data)
|
|
}),
|
|
delete: (url: string) => apiCall(url, { method: 'DELETE' }),
|
|
}; |