Skip to content

Don't open Stripe checkout sessions for scripts and scanners #203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danielehrhardt merged 1 commit into from
Oct 18, 2026
Merged

Don't open Stripe checkout sessions for scripts and scanners #203

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions apps/website/src/pages/api/checkout.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,18 @@ const unavailable = (wantsJson: boolean) =>
? Response.json({ error: 'plan_unavailable' }, { status: 410 })
: new Response(null, { status: 303, headers: { location: '/#pricing' } });

// Scripts, scanners and uptime checks must not open live Stripe sessions: they pile up as expired
// checkouts with no email and make the funnel look like real people quit at the card step.
const isBot = (request: Request) => BOTS.test(request.headers.get('user-agent') ?? '');

export const POST: APIRoute = async ({ request, url }) => {
const wantsJson = (request.headers.get('accept') ?? '').includes('application/json');
let plan: Plan = 'monthly';
if (isBot(request)) {
return wantsJson
? Response.json({ error: 'not_a_browser' }, { status: 403 })
: new Response(null, { status: 303, headers: { location: '/#pricing' } });
}

try {
if (!(await allowed('CHECKOUT_LIMIT', request))) {
Expand Down Expand Up @@ -132,18 +141,18 @@ export const POST: APIRoute = async ({ request, url }) => {
export const GET: APIRoute = async (ctx) => {
if (RETIRED.has(ctx.url.searchParams.get('plan') ?? '')) return unavailable(false);
const plan = planFrom(ctx.url.searchParams.get('plan'));
if (BOTS.test(ctx.request.headers.get('user-agent') ?? '')) {
if (isBot(ctx.request)) {
return new Response(null, { status: 303, headers: { location: '/#pricing' } });
}
const form = new URLSearchParams({ plan });
for (const k of ATTR_KEYS) {
const v = ctx.url.searchParams.get(k);
if (v) form.set(k, v);
}
const request = new Request(ctx.request.url, {
method: 'POST',
headers: { 'content-type': 'application/x-www-form-urlencoded' },
body: form,
});
// Keep the visitor's IP and user agent so the rate limit and bot check still apply.
const headers = new Headers(ctx.request.headers);
headers.set('content-type', 'application/x-www-form-urlencoded');
headers.delete('content-length');
const request = new Request(ctx.request.url, { method: 'POST', headers, body: form });
return POST({ ...ctx, request });
};
Loading