diff --git a/apps/web/middleware.test.ts b/apps/web/middleware.test.ts index 9f91d699469cb8..8ed42c081c1838 100644 --- a/apps/web/middleware.test.ts +++ b/apps/web/middleware.test.ts @@ -3,7 +3,7 @@ import { describe, it, expect } from "vitest"; import { WEBAPP_URL } from "@calcom/lib/constants"; -import { checkPostMethod, POST_METHODS_ALLOWED_APP_ROUTES } from "./middleware"; +import { checkPostMethod } from "./middleware"; describe("Middleware - POST requests restriction", () => { const createRequest = (path: string, method: string) => { @@ -24,14 +24,6 @@ describe("Middleware - POST requests restriction", () => { expect(res2).toBeNull(); }); - it("should allow POST requests to allowed app routes", async () => { - POST_METHODS_ALLOWED_APP_ROUTES.forEach(async (route) => { - const req = createRequest(route, "POST"); - const res = checkPostMethod(req); - expect(res).toBeNull(); - }); - }); - it("should block POST requests to not-allowed app routes", async () => { const req = createRequest("/team/xyz", "POST"); const res = checkPostMethod(req); diff --git a/apps/web/middleware.ts b/apps/web/middleware.ts index 96bdacb626d935..ffec08e63c320d 100644 --- a/apps/web/middleware.ts +++ b/apps/web/middleware.ts @@ -16,21 +16,9 @@ const safeGet = async (key: string): Promise => { }; export const POST_METHODS_ALLOWED_API_ROUTES = ["/api/auth/signup", "/api/trpc/"]; -// Some app routes are allowed because "revalidatePath()" is used to revalidate the cache for them -export const POST_METHODS_ALLOWED_APP_ROUTES = [ - "/settings/my-account/general", - "/settings/developer/webhooks", - "/settings/developer/api-keys", - "/teams", -]; export function checkPostMethod(req: NextRequest) { const pathname = req.nextUrl.pathname; - if ( - ![...POST_METHODS_ALLOWED_API_ROUTES, ...POST_METHODS_ALLOWED_APP_ROUTES].some((route) => - pathname.startsWith(route) - ) && - req.method === "POST" - ) { + if (!POST_METHODS_ALLOWED_API_ROUTES.some((route) => pathname.startsWith(route)) && req.method === "POST") { return new NextResponse(null, { status: 405, statusText: "Method Not Allowed", @@ -191,11 +179,6 @@ export const config = { // API routes "/api/auth/signup", "/api/trpc/:path*", - // Routes allowed for POST method (matching `POST_METHODS_ALLOWED_APP_ROUTES` array) - "/settings/my-account/general", - "/settings/developer/webhooks", - "/settings/developer/api-keys", - "/teams", ], };