Hello,
I’m working on an MVP that allows users to configure their models and purchase the corresponding export file. During testing, I implemented a piece of logic to handle export file generation, based on this snippet
<Button
onClick={async () => {
const session = sessionRef.current;
const exportObject = session?.getExportByName("Download 3MF")[0];
const response = await exportObject?.request();
if (response?.content && response.filename) {
const downloadUrl: string = (response.content?.[0] as { href: string }).href;
const link = document.createElement("a");
link.href = downloadUrl;
link.download = response.filename;
link.click();
}
}}
>
Download Export
</Button>
This logic is meant for testing, but in the final version, it will be moved to an external API service. The service will be triggered after the customer completes the checkout process. We’ll store the export file, generate a unique download link, and provide it to the customer.
During testing, I noticed that this code triggers this PUT /api/v2/session/{sessionId}/export call as seen in the network tab.
My concern is that as long as someone has access to the session ID (which is also visible in the network tab), they could potentially spoof the origin, make the PUT request themselves, and retrieve the export file URL.
Is there a way to secure this endpoint? Ideally, I’d like to add authorization to prevent unauthorized export generation. Any advice on how to achieve this would be greatly appreciated.
