1f3d3a8f7f
The shutdown API calls `process.exit(0)` on POST without any authentication or authorization checks. Any party that can reach this endpoint can terminate the server process, causing immediate service disruption. Affected files: route.js Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>
24 lines
693 B
JavaScript
24 lines
693 B
JavaScript
import { NextResponse } from "next/server";
|
|
import { headers } from "next/headers";
|
|
|
|
export async function POST() {
|
|
if (process.env.NODE_ENV === "production") {
|
|
return NextResponse.json({ success: false, message: "Not allowed in production" }, { status: 403 });
|
|
}
|
|
|
|
const secret = process.env.SHUTDOWN_SECRET;
|
|
const authorization = headers().get("authorization");
|
|
|
|
if (!secret || authorization !== `Bearer ${secret}`) {
|
|
return NextResponse.json({ success: false, message: "Unauthorized" }, { status: 401 });
|
|
}
|
|
|
|
const response = NextResponse.json({ success: true, message: "Shutting down..." });
|
|
|
|
setTimeout(() => {
|
|
process.exit(0);
|
|
}, 500);
|
|
|
|
return response;
|
|
}
|
|
|