Block web browser requests to export endpoint (#6944)

* Block web browser requests to export endpoint * Update src/emulator/hub.ts Co-authored-by: Yuchen Shi <yuchenshi@google.com> --------- Co-authored-by: Yuchen Shi <yuchenshi@google.com>
firebase · Apr 2, 2024 · 068a2b0 · 068a2b0
1 parent dbb8573
commit 068a2b0
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/emulator/hub.ts b/src/emulator/hub.ts
@@ -98,6 +98,11 @@ export class EmulatorHub extends ExpressBasedEmulator {
     });
 
     app.post(EmulatorHub.PATH_EXPORT, async (req, res) => {
+      if (req.headers.origin) {
+        res.status(403).json({
+          message: `Export cannot be triggered by external callers.`,
+        });
+      }
       const path: string = req.body.path;
       const initiatedBy: string = req.body.initiatedBy || "unknown";
       utils.logLabeledBullet("emulators", `Received export request. Exporting data to ${path}.`);