| 
1 |  | -import { NextResponse } from 'next/server';  | 
2 |  | -import type { NextRequest } from 'next/server';  | 
3 |  | - | 
4 |  | -// Simple in-memory rate limiting (consider using Upstash Redis in production)  | 
5 |  | -const rateLimitMap = new Map<string, { count: number; resetTime: number }>();  | 
6 |  | - | 
7 |  | -export function middleware(request: NextRequest) {  | 
8 |  | -  // Security: Block x-middleware-subrequest header (CVE-2025-29927 mitigation)  | 
9 |  | -  if (request.headers.get('x-middleware-subrequest')) {  | 
10 |  | -    return new NextResponse('Forbidden', { status: 403 });  | 
11 |  | -  }  | 
12 |  | - | 
13 |  | -  // Apply rate limiting to API routes  | 
14 |  | -  if (request.nextUrl.pathname.startsWith('/api/')) {  | 
15 |  | -    const ip = request.headers.get('x-forwarded-for') || request.headers.get('x-real-ip') || 'unknown';  | 
16 |  | -    const now = Date.now();  | 
17 |  | -    const windowMs = 15 * 60 * 1000; // 15 minutes  | 
18 |  | -    const limit = 100; // 100 requests per 15 minutes  | 
19 |  | - | 
20 |  | -    const userRateLimit = rateLimitMap.get(ip);  | 
21 |  | - | 
22 |  | -    if (!userRateLimit || now > userRateLimit.resetTime) {  | 
23 |  | -      rateLimitMap.set(ip, { count: 1, resetTime: now + windowMs });  | 
24 |  | -    } else {  | 
25 |  | -      userRateLimit.count++;  | 
26 |  | - | 
27 |  | -      if (userRateLimit.count > limit) {  | 
28 |  | -        return new NextResponse(JSON.stringify({ error: 'Too many requests' }), {  | 
29 |  | -          status: 429,  | 
30 |  | -          headers: {  | 
31 |  | -            'Content-Type': 'application/json',  | 
32 |  | -            'X-RateLimit-Limit': limit.toString(),  | 
33 |  | -            'X-RateLimit-Remaining': '0',  | 
34 |  | -            'X-RateLimit-Reset': new Date(userRateLimit.resetTime).toISOString(),  | 
35 |  | -          },  | 
36 |  | -        });  | 
37 |  | -      }  | 
38 |  | -    }  | 
39 |  | - | 
40 |  | -    // Clean up old entries periodically  | 
41 |  | -    if (rateLimitMap.size > 1000) {  | 
42 |  | -      for (const [key, value] of rateLimitMap.entries()) {  | 
43 |  | -        if (now > value.resetTime) {  | 
44 |  | -          rateLimitMap.delete(key);  | 
45 |  | -        }  | 
46 |  | -      }  | 
47 |  | -    }  | 
48 |  | -  }  | 
49 |  | - | 
50 |  | -  // Add security headers for API routes  | 
51 |  | -  const response = NextResponse.next();  | 
52 |  | - | 
53 |  | -  if (request.nextUrl.pathname.startsWith('/api/')) {  | 
54 |  | -    response.headers.set('X-Content-Type-Options', 'nosniff');  | 
55 |  | -    response.headers.set('X-Frame-Options', 'DENY');  | 
56 |  | -    response.headers.set('X-XSS-Protection', '1; mode=block');  | 
57 |  | -  }  | 
58 |  | - | 
59 |  | -  return response;  | 
60 |  | -}  | 
61 |  | - | 
62 |  | -export const config = {  | 
63 |  | -  matcher: [  | 
64 |  | -    '/api/:path*'  | 
65 |  | -  ],  | 
66 |  | -};  | 
 | 1 | +// Middleware temporarily disabled for debugging  | 
 | 2 | +// import { NextResponse } from 'next/server';  | 
 | 3 | +// import type { NextRequest } from 'next/server';  | 
 | 4 | + | 
 | 5 | +// export function middleware(request: NextRequest) {  | 
 | 6 | +//   return NextResponse.next();  | 
 | 7 | +// }  | 
 | 8 | + | 
 | 9 | +// export const config = {  | 
 | 10 | +//   matcher: [  | 
 | 11 | +//     '/api/:path*'  | 
 | 12 | +//   ],  | 
 | 13 | +// };  | 
0 commit comments