@@ -129,6 +129,37 @@ export function validateRequest(req, res, allowedMethod) {
129129
130130 // Request token validation to prevent API automation
131131 const expectedToken = generateRequestToken ( req ) ;
132+
133+ // Debug logging to diagnose token validation issues
134+ console . log ( "Request headers:" , {
135+ host : req . headers . host ,
136+ origin : req . headers . origin ,
137+ referer : req . headers . referer ,
138+ // Truncate user-agent to avoid huge logs
139+ userAgent : req . headers [ "user-agent" ] ?. substring ( 0 , 50 ) + "..." ,
140+ } ) ;
141+
142+ // Log token information
143+ console . log ( "Token comparison:" , {
144+ received : requestToken ,
145+ expected : expectedToken ,
146+ matches : requestToken === expectedToken ,
147+ } ) ;
148+
149+ // If there's a mismatch, decode both tokens to see what's different
150+ if ( requestToken !== expectedToken ) {
151+ try {
152+ const decodedReceived = Buffer . from ( requestToken , "base64" ) . toString ( ) ;
153+ const decodedExpected = Buffer . from ( expectedToken , "base64" ) . toString ( ) ;
154+ console . log ( "Decoded tokens:" , {
155+ received : decodedReceived ,
156+ expected : decodedExpected ,
157+ } ) ;
158+ } catch ( e ) {
159+ console . log ( "Error decoding tokens:" , e . message ) ;
160+ }
161+ }
162+
132163 if ( ! requestToken || requestToken !== expectedToken ) {
133164 return res . status ( 403 ) . json ( {
134165 error : "Access denied" ,
0 commit comments