Blocked origins

VoidCat/Controllers/DownloadController.cs

@@ -111,6 +111,16 @@ public class DownloadController : Controller
 
     private async Task<VoidFileResponse?> SetupDownload(Guid id)
     {
+        var origin = Request.Headers.Origin.FirstOrDefault();
+        if (!string.IsNullOrEmpty(origin) && Uri.TryCreate(origin, UriKind.RelativeOrAbsolute, out var u))
+        {
+            if (_settings.BlockedOrigins.Any(a => string.Equals(a, u.DnsSafeHost, StringComparison.InvariantCultureIgnoreCase)))
+            {
+                Response.StatusCode = (int)HttpStatusCode.Forbidden;
+                return default;
+            }
+        }
+
         var meta = await _fileInfo.Get(id, false);
         if (meta == null)
         {
@@ -182,6 +192,7 @@ public class DownloadController : Controller
             {
                 return true;
             }
+
             if (order?.Status is PaywallOrderStatus.Unpaid)
             {
                 // check status
@@ -191,6 +202,7 @@ public class DownloadController : Controller
                 {
                     await _paymentOrders.UpdateStatus(order.Id, status.Status);
                 }
+
                 if (status?.Status == PaywallOrderStatus.Paid)
                 {
                     return true;

VoidCat/Model/VoidSettings.cs

@@ -132,6 +132,11 @@ namespace VoidCat.Model
         /// Lightning node configuration for LNProxy services
         /// </summary>
         public LndConfig? LndConfig { get; init; }
+
+        /// <summary>
+        /// Blocked origin hostnames
+        /// </summary>
+        public List<string> BlockedOrigins { get; init; } = new();
     }
 
     public sealed class TorSettings