Add spam filter middleware to block common attack patterns

apps/bio/src/middleware.ts

@@ -1,9 +1,12 @@
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
 import { parseBioUrl, setVisitorCookies } from '@barely/lib/middleware/request-parsing';
+import { isSpamRequest, spamResponse } from '@barely/lib/middleware/spam-filter';
 import { log } from '@barely/lib/utils/log';
 
 export async function middleware(req: NextRequest) {
+	if (isSpamRequest(req.nextUrl.pathname)) return spamResponse();
+
 	const { handle, key } = parseBioUrl(req.url);
 
 	console.log('bio middleware', handle, key);

apps/cart/src/middleware.ts

@@ -5,13 +5,16 @@ import {
 	parseReqForVisitorInfo,
 	setVisitorCookies,
 } from '@barely/lib/middleware/request-parsing';
+import { isSpamRequest, spamResponse } from '@barely/lib/middleware/spam-filter';
 import { log } from '@barely/lib/utils/log';
 import { getAbsoluteUrl, isDevelopment, newId } from '@barely/utils';
 
 import type { CreateCartBody } from '~/app/api/cart/create/route';
 import { cartEnv } from '~/env';
 
 export async function middleware(req: NextRequest, ev: NextFetchEvent) {
+	if (isSpamRequest(req.nextUrl.pathname)) return spamResponse();
+
 	const domain = req.headers.get('host');
 	const pathname = req.nextUrl.pathname;
 

apps/link/src/middleware.ts

@@ -8,6 +8,7 @@ import { sqlAnd } from '@barely/db/utils';
 import { recordLinkClick } from '@barely/lib/functions/event.fns';
 import { parseLink } from '@barely/lib/middleware';
 import { parseReqForVisitorInfo } from '@barely/lib/middleware/request-parsing';
+import { isSpamRequest, spamResponse } from '@barely/lib/middleware/spam-filter';
 import { getAbsoluteUrl } from '@barely/utils';
 import { eq } from 'drizzle-orm';
 
@@ -18,6 +19,8 @@ export const config = {
 };
 
 export async function middleware(req: NextRequest, ev: NextFetchEvent) {
+	if (isSpamRequest(req.nextUrl.pathname)) return spamResponse();
+
 	const url = req.nextUrl;
 	const linkProps = parseLink(req);
 

apps/nyc/src/middleware.ts

@@ -1,8 +1,11 @@
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
 import { setVisitorCookies } from '@barely/lib/middleware/request-parsing';
+import { isSpamRequest, spamResponse } from '@barely/lib/middleware/spam-filter';
 
 export async function middleware(req: NextRequest) {
+	if (isSpamRequest(req.nextUrl.pathname)) return spamResponse();
+
 	const res = NextResponse.next();
 
 	// Set visitor cookies to persist tracking parameters (fbclid, sessionId, etc.)

apps/vip/src/middleware.ts

@@ -1,9 +1,12 @@
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
 import { setVisitorCookies } from '@barely/lib/middleware/request-parsing';
+import { isSpamRequest, spamResponse } from '@barely/lib/middleware/spam-filter';
 import { log } from '@barely/lib/utils/log';
 
 export async function middleware(req: NextRequest) {
+	if (isSpamRequest(req.nextUrl.pathname)) return spamResponse();
+
 	const pathname = req.nextUrl.pathname;
 
 	// Parse the VIP URL to extract handle and key

packages/lib/package.json

@@ -56,6 +56,10 @@
 			"types": "./dist/src/middleware/request-parsing.d.ts",
 			"default": "./src/middleware/request-parsing.ts"
 		},
+		"./middleware/spam-filter": {
+			"types": "./dist/src/middleware/spam-filter.d.ts",
+			"default": "./src/middleware/spam-filter.ts"
+		},
 		"./trigger/*": {
 			"types": "./dist/src/integrations/trigger/*.d.ts",
 			"default": "./src/integrations/trigger/*.ts"

packages/lib/src/middleware/spam-filter.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from 'next/server';
+
+const SPAM_PATTERNS = [
+	'.php',
+	'license.txt',
+	'wp-content',
+	'wp-admin',
+	'wp-includes',
+	'wp-login',
+	'xmlrpc',
+	'.trash',
+	'.env',
+];
+
+export function isSpamRequest(pathname: string): boolean {
+	const lower = pathname.toLowerCase();
+	const matched = SPAM_PATTERNS.find(pattern => lower.includes(pattern));
+	if (matched) console.log(`[spam-filter] blocked "${pathname}" (matched: ${matched})`);
+	return !!matched;
+}
+
+export function spamResponse() {
+	return new NextResponse('Nice try. Pls go away.', {
+		status: 418,
+	});
+}