do not accept unauthenticated users to replays

mytja · Nov 17, 2023 · d444f83 · d444f83
1 parent cbb3514
commit d444f83
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/backend/main.go b/backend/main.go
@@ -236,6 +236,10 @@ func run(config *consts.ServerConfig) {
 	})
 	mux.HandleFunc(pat.Get("/replay/:game_id"), func(w http.ResponseWriter, r *http.Request) {
 		user, err := db.CheckToken(r)
+		if err != nil {
+			w.WriteHeader(http.StatusForbidden)
+			return
+		}
 
 		gameId := pat.Param(r, "game_id")
 		game, err := db.GetGame(gameId)