contrarian FIX FIRST #1: block /api/send for tunnel-origin requests (loopback-only mail send)

cf2ad961407c52f5be74afba107d0b99d4c1146f · 2026-07-12 11:28:55 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit cf2ad961407c52f5be74afba107d0b99d4c1146f
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Sun Jul 12 11:28:55 2026 -0700

    contrarian FIX FIRST #1: block /api/send for tunnel-origin requests (loopback-only mail send)
---
 server.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server.js b/server.js
index 69de75d..dfb5f65 100644
--- a/server.js
+++ b/server.js
@@ -387,6 +387,16 @@ app.get('/api/lastcorr', async (req, res) => {
 // we pass that back verbatim. Each send is a deliberate per-recipient click in the UI.
 app.post('/api/send', async (req, res) => {
   try {
+    // TUNNEL-ORIGIN SEND GUARD (contrarian FIX FIRST #1): this endpoint emails as
+    // info@designerwallcoverings.com with the George external-send token auto-attached.
+    // When reached through the PUBLIC cloudflared tunnel, cloudflared stamps the request
+    // with cf-connecting-ip / x-forwarded-for. Refuse the actual send for those — remote
+    // users may view + draft, but firing client email is restricted to a direct
+    // local-loopback operator (someone physically at this Mac). Basic Auth alone is not a
+    // strong enough gate to hand the internet a send-as-info@ button.
+    if (req.get('cf-connecting-ip') || req.get('x-forwarded-for')) {
+      return res.status(403).json({ error: 'Sending is disabled over the public tunnel. Open this tool locally to send — drafting and preview still work remotely.', tunnelBlocked: true });
+    }
     const { to, subject, body, samples, list, account: acctNo, company } = req.body || {};
     if (!to || !subject || !body) return res.status(400).json({ error: 'to, subject and body are required' });
     if (!/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(String(to).trim())) return res.status(400).json({ error: `not a valid recipient email: ${to}` });

← 10b262d 5x: REPORT.md — 2 sweeps, app clean, M3 networkidle proven C · back to Dw Pitch Followup · contrarian FIX FIRST #2: per-IP brute-force lockout on publi 577f14f →