@@ -53,6 +53,18 @@ export async function tidewaveHandler(
5353 return async function handler ( req : NextApiRequest , res : NextApiResponse ) : Promise < void > {
5454 const origin = req . headers . host ;
5555
56+ // Parse endpoint manually, rewrite doesn't populate query
57+ const url = new URL ( req . url ?? '' , `http://${ origin } ` ) ;
58+ const segments = url . pathname . split ( '/' ) . filter ( Boolean ) ;
59+ const [ _tidewave , endpoint ] = segments ;
60+
61+ // Note that this is the original request URL, not accounting for
62+ // Next.js rewrite. We validate that the request targets /tidewave,
63+ // rather than /api/tidewave.
64+ if ( ! url . pathname . startsWith ( '/tidewave' ) ) {
65+ return res . status ( 404 ) . json ( { message : 'This route only works when accessed at /tidewave' } ) ;
66+ }
67+
5668 if ( origin ) {
5769 const [ hostname , port ] = origin . split ( ':' ) ;
5870 config . host = hostname ? hostname : config . host ;
@@ -64,11 +76,6 @@ export async function tidewaveHandler(
6476 await connectWrapper ( securityMiddleware ) ( req , res , next ) ;
6577 await connectWrapper ( bodyParser . json ( ) ) ( req , res , next ) ;
6678
67- // Parse endpoint manually, rewrite doesn't populate query
68- const url = new URL ( req . url ?? '' , `http://${ origin } ` ) ;
69- const segments = url . pathname . split ( '/' ) . filter ( Boolean ) ;
70- const [ _tidewave , endpoint ] = segments ;
71-
7279 if ( req . method === 'GET' && endpoint === undefined ) {
7380 return await respondTidewaveHTML ( res , config ) ;
7481 }
0 commit comments