From 01117fddd3502c57bc20a65a75a66a4900d5d67d Mon Sep 17 00:00:00 2001 From: dawn Date: Sat, 25 Jul 2026 03:21:43 +0300 Subject: [PATCH] camo: verify hmac before checking the cache Signed-off-by: dawn --- camo/src/index.js | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/camo/src/index.js b/camo/src/index.js index 6b0ecdf1..a9b9893f 100644 --- a/camo/src/index.js +++ b/camo/src/index.js @@ -22,14 +22,9 @@ export default { ); const targetUrl = new TextDecoder().decode(urlBytes); - // check if we have an entry in the cache with the target url - let cacheKey = new Request(targetUrl); - let response = await cache.match(cacheKey); - if (response) { - return response; - } - - // else compute the signature + // check signature before we lookup cache, if we do the other way + // then any random signature for the same url will be let through after + // a single successful request const key = await crypto.subtle.importKey( "raw", new TextEncoder().encode(env.CAMO_SHARED_SECRET), @@ -60,6 +55,13 @@ export default { return new Response("Invalid signature", { status: 403 }); } + // check if we have an entry in the cache with the target url + let cacheKey = new Request(targetUrl); + let response = await cache.match(cacheKey); + if (response) { + return response; + } + let parsedUrl; try { parsedUrl = new URL(targetUrl); -- 2.51.2