tangled.org
Monorepo for Tangled
tangled.org
camo: verify hmac before checking the cache
Signed-off-by: dawn <dawn@tangled.org>
author
dawn
date
(Jul 25, 2026, 3:43 AM +0300)
commit
01117fdd
01117fddd3502c57bc20a65a75a66a4900d5d67d
parent
0c4d0e9b
0c4d0e9b07940033721395a434b5873f0fb9e6c8
change-id
qzpwynlw
qzpwynlwovnlxppukpxzrywpvxnkpoop
+10
-8
+10
-8
camo/src/index.js
+10
-8
camo/src/index.js
···
22
22
);
23
23
const targetUrl = new TextDecoder().decode(urlBytes);
24
24
25
-
// check if we have an entry in the cache with the target url
26
-
let cacheKey = new Request(targetUrl);
27
-
let response = await cache.match(cacheKey);
28
-
if (response) {
29
-
return response;
30
-
}
31
-
32
-
// else compute the signature
25
+
// check signature before we lookup cache, if we do the other way
26
+
// then any random signature for the same url will be let through after
27
+
// a single successful request
33
28
const key = await crypto.subtle.importKey(
34
29
"raw",
35
30
new TextEncoder().encode(env.CAMO_SHARED_SECRET),
···
58
53
59
54
if (!valid) {
60
55
return new Response("Invalid signature", { status: 403 });
56
+
}
57
+
58
+
// check if we have an entry in the cache with the target url
59
+
let cacheKey = new Request(targetUrl);
60
+
let response = await cache.match(cacheKey);
61
+
if (response) {
62
+
return response;
61
63
}
62
64
63
65
let parsedUrl;