Pages functions access
Hello everyone,
I'm using pages to host a Gatsby site and I'm using the functions directory to handle the contact form post requests.
Are these functions allow requests only from this project or I have to restrict it somehow so the functions endpoint block requests from another project/domain?
5 Replies
the functions accept requests from anywhere. any sort of permission logic, origin-based or otherwise, will need to be handled in your function code.
Thank you for the answer!
Tbh I thought it would be restricted for that particular project by default.
What would be the best approach to restrict it only for the pages.dev and any custom domain of the project?
this isn't really a pages-specific thing but rather a nodejs thing. your pages function has a request object that you can use to write any logic you want. console.log it, submit your contact form, check the logs for any useful fields. sounds like you want to restrict requests by host. you'll probably want to check the headers for the "Referer" header and then allow/deny access based on the host in that value.
here's an example of a hostname check: https://developers.cloudflare.com/workers/examples/hot-link-protection/
Hot-link protection · Cloudflare Workers docs
Documentation for Cloudflare Workers, a serverless execution environment that allows you to create entirely new applications or augment existing ones …
note that the example is a workers example, not a pages example, so the top-level stuff won't match up perfectly. the
new URL bit will though