Remove SSR no-origin allowance and add .dockerignore (#9)

Author: kappil-garg

.dockerignore

@@ -0,0 +1,74 @@
+# Git
+.git
+.gitignore
+.gitattributes
+
+# Documentation
+*.md
+README.md
+HOSTING_OPTIONS.md
+RAILWAY_DEPLOYMENT.md
+
+# IDE
+.idea
+.vscode
+*.iml
+*.ipr
+*.iws
+.settings
+.project
+.classpath
+
+# Build outputs (will be built in container)
+build/
+out/
+target/
+dist/
+.gradle/
+
+# Test files
+src/test/
+test/
+*.test.*
+
+# Logs
+*.log
+logs/
+
+# Environment files
+.env
+.env.*
+*.env
+*.env.local
+*.env.*.local
+
+# OS files
+.DS_Store
+Thumbs.db
+*.swp
+*.swo
+*.bak
+
+# Node (if any)
+node_modules/
+npm-debug.log
+yarn-error.log
+
+# Coverage reports
+coverage/
+.nyc_output/
+test-results/
+
+# Temporary files
+*.tmp
+*.temp
+.cache/
+
+# Railway specific (if any)
+railway.json
+.railway/
+
+# Docker
+Dockerfile*
+docker-compose*.yml
+.dockerignore

gradle.properties

@@ -1 +1 @@
-version=1.11.1
+version=1.11.2

src/main/java/com/kapil/personalwebsite/config/OriginVerificationFilter.java

@@ -35,21 +35,18 @@ public class OriginVerificationFilter implements Filter {
     private static final Logger LOGGER = LoggerFactory.getLogger(OriginVerificationFilter.class);
 
     private final String serverApiKey;
-    private final boolean allowNoOriginForSSR;
     private final Set<String> allowedOriginsSet;
 
     public OriginVerificationFilter(@Value("${api.server-key}") String serverApiKey,
-                                    @Value("${cors.allowed-origins}") String allowedOrigins,
-                                    @Value("${ssr.allow-no-origin}") boolean allowNoOriginForSSR) {
+                                    @Value("${cors.allowed-origins}") String allowedOrigins) {
         this.serverApiKey = serverApiKey;
-        this.allowNoOriginForSSR = allowNoOriginForSSR;
         if (StringUtils.hasText(allowedOrigins)) {
             this.allowedOriginsSet = Arrays.stream(allowedOrigins.split(","))
                     .map(String::trim)
                     .filter(StringUtils::hasText)
                     .collect(Collectors.toSet());
-            LOGGER.info("OriginVerificationFilter initialized with {} allowed origins, SSR allowed: {}",
-                    allowedOriginsSet.size(), allowNoOriginForSSR);
+            LOGGER.info("OriginVerificationFilter initialized with {} allowed origins",
+                    allowedOriginsSet.size());
         } else {
             this.allowedOriginsSet = Collections.emptySet();
             LOGGER.warn("No allowed origins configured for OriginVerificationFilter. All non-API key requests will be blocked.");
@@ -125,7 +122,7 @@ private boolean isRequestAuthorized(HttpServletRequest request) {
     }
 
     /**
-     * Authorize non-blog endpoints based on user authentication, API key, Origin, Referer headers, or SSR allowance.
+     * Authorize non-blog endpoints based on user authentication, API key, Origin, or Referer headers.
      *
      * @param request the HTTP servlet request
      * @return true if authorized, false otherwise
@@ -141,13 +138,7 @@ private boolean authorizeOtherEndpoint(HttpServletRequest request) {
         String referer = request.getHeader(AppConstants.REFERER_HEADER);
         if (StringUtils.hasText(referer)) {
             String refererOrigin = extractOriginFromReferer(referer);
-            if (refererOrigin != null && isAllowedOrigin(refererOrigin)) {
-                return true;
-            }
-        }
-        if (allowNoOriginForSSR && isLikelySSRRequest(request)) {
-            LOGGER.debug("Allowing SSR request without Origin header from: {}", request.getRemoteAddr());
-            return true;
+            return refererOrigin != null && isAllowedOrigin(refererOrigin);
         }
         return false;
     }
@@ -177,22 +168,6 @@ private boolean isBlogEndpoint(String servletPath) {
         return AppConstants.PUBLIC_BLOG_PATHS.stream().anyMatch(servletPath::startsWith);
     }
 
-    /**
-     * Determine if the request is likely an SSR/server request based on absence of Origin header.
-     *
-     * @param request the HTTP servlet request
-     * @return true if this appears to be an SSR/server request
-     */
-    private boolean isLikelySSRRequest(HttpServletRequest request) {
-        String origin = request.getHeader(AppConstants.ORIGIN_HEADER);
-        if (!StringUtils.hasText(origin)) {
-            LOGGER.debug("Detected server-to-server request (no Origin header) from: {}",
-                    request.getRemoteAddr());
-            return true;
-        }
-        return false;
-    }
-
     /**
      * Check if the given origin is in the list of allowed origins.
      *

src/main/resources/application.properties

@@ -41,9 +41,6 @@ logging.level.org.springframework.data.mongodb=${MONGO_LOG_LEVEL:WARN}
 # API Server Key (required for SSR/server-to-server requests)
 api.server-key=${API_SERVER_KEY:}
 
-# SSR Configuration to allow requests without Origin header (for SSR/server-to-server)
-ssr.allow-no-origin=${SSR_ALLOW_NO_ORIGIN:false}
-
 # Email Configuration
 email.provider=${EMAIL_PROVIDER:}
 email.http-api.api-key=${EMAIL_HTTP_API_KEY:}

src/test/java/com/kapil/personalwebsite/config/OriginVerificationFilterTest.java

@@ -49,12 +49,8 @@ void setUp() throws IOException {
         when(response.getWriter()).thenReturn(new PrintWriter(responseWriter));
     }
 
-    private void initFilter(String allowedOrigins, String serverApiKey, boolean allowNoOriginForSSR) {
-        filter = new OriginVerificationFilter(serverApiKey, allowedOrigins, allowNoOriginForSSR);
-    }
-
     private void initFilter(String allowedOrigins, String serverApiKey) {
-        initFilter(allowedOrigins, serverApiKey, true);
+        filter = new OriginVerificationFilter(serverApiKey, allowedOrigins);
     }
 
     @Nested
@@ -82,13 +78,13 @@ void testInitialize_WithEmptyOrigins_ShouldHandleGracefully() {
     class NonProtectedEndpointTests {
 
         @Test
-        @DisplayName("Should allow requests to non-protected endpoints")
-        void testDoFilter_NonProtectedEndpoint_ShouldAllow() throws Exception {
+        @DisplayName("Should block requests to non-excluded endpoints without authorization")
+        void testDoFilter_NonProtectedEndpoint_ShouldBlock() throws Exception {
             initFilter("https://example.com", "test-key");
             when(request.getRequestURI()).thenReturn("/api/health");
             filter.doFilter(request, response, filterChain);
-            verify(filterChain).doFilter(request, response);
-            verify(response, never()).setStatus(anyInt());
+            verify(filterChain, never()).doFilter(request, response);
+            verify(response).setStatus(HttpStatus.FORBIDDEN.value());
         }
 
         @Test
@@ -152,9 +148,9 @@ void testDoFilter_WithValidApiKey_ShouldAllow() throws Exception {
         }
 
         @Test
-        @DisplayName("Should block invalid API key when SSR is disabled")
+        @DisplayName("Should block invalid API key")
         void testDoFilter_WithInvalidApiKey_SSRDisabled_ShouldBlock() throws Exception {
-            initFilter("https://example.com", "test-secret-key", false);
+            initFilter("https://example.com", "test-secret-key");
             when(request.getRequestURI()).thenReturn("/blogs/published");
             when(request.getMethod()).thenReturn("GET");
             when(request.getHeader("X-API-Key")).thenReturn("wrong-key");
@@ -195,9 +191,9 @@ void testDoFilter_WithValidReferer_ShouldAllow() throws Exception {
         }
 
         @Test
-        @DisplayName("Should block invalid referer when SSR is disabled")
+        @DisplayName("Should block invalid referer")
         void testDoFilter_WithInvalidReferer_SSRDisabled_ShouldBlock() throws Exception {
-            initFilter("https://example.com", "test-key", false);
+            initFilter("https://example.com", "test-key");
             when(request.getRequestURI()).thenReturn("/blogs/published");
             when(request.getMethod()).thenReturn("GET");
             when(request.getHeader("Referer")).thenReturn("https://malicious.com/hack");
@@ -234,25 +230,13 @@ void testDoFilter_OriginPrecedence_ShouldUseOrigin() throws Exception {
     }
 
     @Nested
-    @DisplayName("SSR Detection Tests")
-    class SSRDetectionTests {
-
-        @Test
-        @DisplayName("Should allow SSR requests (no Origin) when SSR is enabled")
-        void testDoFilter_NoOrigin_SSREnabled_ShouldAllow() throws Exception {
-            initFilter("https://example.com", "test-key", true);
-            when(request.getRequestURI()).thenReturn("/blogs/published");
-            when(request.getMethod()).thenReturn("GET");
-            when(request.getRemoteAddr()).thenReturn("127.0.0.1");
-            filter.doFilter(request, response, filterChain);
-            verify(filterChain).doFilter(request, response);
-            verify(response, never()).setStatus(anyInt());
-        }
+    @DisplayName("Missing Origin Header Tests")
+    class MissingOriginHeaderTests {
 
         @Test
-        @DisplayName("Should block requests without Origin when SSR is disabled")
-        void testDoFilter_NoOrigin_SSRDisabled_ShouldBlock() throws Exception {
-            initFilter("https://example.com", "test-key", false);
+        @DisplayName("Should block requests without Origin header")
+        void testDoFilter_NoOriginHeader_ShouldBlock() throws Exception {
+            initFilter("https://example.com", "test-key");
             when(request.getRequestURI()).thenReturn("/blogs/published");
             when(request.getMethod()).thenReturn("GET");
             filter.doFilter(request, response, filterChain);
@@ -261,9 +245,9 @@ void testDoFilter_NoOrigin_SSRDisabled_ShouldBlock() throws Exception {
         }
 
         @Test
-        @DisplayName("Browser request with invalid Origin should still be blocked even with SSR enabled")
+        @DisplayName("Should block requests with invalid Origin header")
         void testDoFilter_BrowserWithInvalidOrigin_SSREnabled_ShouldBlock() throws Exception {
-            initFilter("https://example.com", "test-key", true);
+            initFilter("https://example.com", "test-key");
             when(request.getRequestURI()).thenReturn("/blogs/published");
             when(request.getMethod()).thenReturn("GET");
             when(request.getHeader("Origin")).thenReturn("https://malicious.com");