Skip to content
This repository was archived by the owner on Jan 17, 2026. It is now read-only.

cors headers to stop broke cunts using your api #6

Open
stubbo wants to merge 9 commits into
base: main
Choose a base branch
from
Open

cors headers to stop broke cunts using your api #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
efc0df9
Initial plan
Copilot Dec 13, 2025
8ac932a
Add CORS environment variable configuration to prevent unauthorized A…
Copilot Dec 13, 2025
ae9ae3e
Add robust validation for CORS origins with URL format checking
Copilot Dec 13, 2025
fdfc35b
Merge pull request #1 from stubbo/copilot/add-cors-headers-to-api
stubbo Dec 13, 2025
584932e
Initial plan
Copilot Dec 13, 2025
83dd15b
Add config validation using @t3-oss/env-core and zod
Copilot Dec 13, 2025
52c9670
Merge pull request #2 from stubbo/copilot/create-config-validation-wi…
stubbo Dec 13, 2025
2e5335a
Update bun.lock with new dependency versions
stubbo Dec 13, 2025
d26f073
Delete package-lock.json
stubbo Dec 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,4 @@
HYTALE_EMAIL=
HYTALE_PASSWORD=
HYTALE_EMAIL=
HYTALE_PASSWORD=
CORS_ORIGINS=http://localhost:3000,https://example.com
REDIS_URL=redis://localhost:6379
6 changes: 6 additions & 0 deletions bun.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 3 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,12 @@
},
"dependencies": {
"@elysiajs/cors": "^1.4.0",
"@t3-oss/env-core": "^0.13.8",
"@upstash/ratelimit": "^2.0.7",
"elysia": "^1.4.18",
"fetch-cookie": "^3.1.0",
"ioredis": "^5.8.2",
"tough-cookie": "^6.0.0"
"tough-cookie": "^6.0.0",
"zod": "^4.1.13"
}
}
20 changes: 20 additions & 0 deletions src/env.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
import { createEnv } from "@t3-oss/env-core";
import { z } from "zod";

export const env = createEnv({
server: {
HYTALE_EMAIL: z.string().email("HYTALE_EMAIL must be a valid email address"),
HYTALE_PASSWORD: z.string().min(1, "HYTALE_PASSWORD must not be empty"),
CORS_ORIGINS: z
.string()
.min(1, "CORS_ORIGINS must contain at least one origin")
.transform((val) => val.split(',').map(origin => origin.trim()).filter(origin => origin.length > 0))
.pipe(
z.array(z.string().url("Each CORS origin must be a valid URL"))
.min(1, "CORS_ORIGINS must contain at least one valid origin")
),
REDIS_URL: z.string().url("REDIS_URL must be a valid URL").default("redis://localhost:6379"),
},
runtimeEnv: process.env,
emptyStringAsUndefined: true,
});
14 changes: 5 additions & 9 deletions src/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,19 +5,15 @@ import fetchCookie from "fetch-cookie";
import { Ratelimit } from "@upstash/ratelimit";
import Redis from "ioredis";
import { createIoRedisAdapter } from "./redis";
import { env } from "./env";

const CREDENTIALS = {
identifier: process.env.HYTALE_EMAIL!,
password: process.env.HYTALE_PASSWORD!,
identifier: env.HYTALE_EMAIL,
password: env.HYTALE_PASSWORD,
};

if (!CREDENTIALS.identifier || !CREDENTIALS.password) {
console.error("Missing HYTALE_EMAIL or HYTALE_PASSWORD in .env");
process.exit(1);
}

// Redis cache
const redis = new Redis(process.env.REDIS_URL || "redis://localhost:6379");
const redis = new Redis(env.REDIS_URL);
const CACHE_PREFIX = "hytale:username:";
const AVAILABLE_TTL = 60; // 1 minute for available names

Expand Down Expand Up @@ -174,7 +170,7 @@ await ensureLoggedIn();
console.log("Connected to Redis");

const app = new Elysia()
.use(cors({ origin: "*" }))
.use(cors({ origin: env.CORS_ORIGINS }))
.get("/", () => ({
message: "Hytale Username Checker API",
endpoints: {
Expand Down