florian.wilde
7cac8cd4fc
- X-Frame-Options/CSP frame-ancestors gegen Clickjacking, nosniff, Referrer-Policy, Permissions-Policy - Origin-Check als CSRF-Defense-in-Depth für /api/admin/users und /logout (zusätzlich zu SameSite=Lax-Cookies und JSON-Content-Type)
13 lines
460 B
TypeScript
13 lines
460 B
TypeScript
import { NextResponse } from "next/server";
|
|
import { createClient } from "@/lib/supabase/server";
|
|
import { isSameOrigin } from "@/lib/origin";
|
|
|
|
export async function POST(request: Request) {
|
|
if (!isSameOrigin(request)) {
|
|
return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
|
|
}
|
|
const supabase = await createClient();
|
|
await supabase.auth.signOut();
|
|
return NextResponse.redirect(new URL("/login", request.url), { status: 303 });
|
|
}
|