feat(webserver): Attempt to block external access to valetudo

thanks @ccoors

backend/lib/doc/Configuration.openapi.json

@@ -38,6 +38,9 @@
               },
               "basicAuth": {
                 "$ref": "#/components/schemas/BasicAuthConfigDTO"
+              },
+              "blockExternalAccess": {
+                "type": "boolean"
               }
             }
           },

backend/lib/res/default_config.json

@@ -12,7 +12,8 @@
             "enabled": false,
             "username": "valetudo",
             "password": "valetudo"
-        }
+        },
+        "blockExternalAccess": true
     },
     "zonePresets": {},
     "goToLocationPresets": {},

backend/lib/webserver/WebServer.js

@@ -57,6 +57,12 @@ class WebServer {
         this.app.use(bodyParser.json());
 
         this.app.disable("x-powered-by");
+
+
+        if (this.webserverConfig.blockExternalAccess) {
+            this.app.use(Middlewares.ExternalAccessCheckMiddleware);
+        }
+
         this.app.use(Middlewares.CSPMiddleware);
         this.app.use(Middlewares.VersionMiddleware);
         this.app.use(Middlewares.ServerMiddleware);

backend/lib/webserver/middlewares/ExternalAccessCheckMiddleware.js

@@ -0,0 +1,18 @@
+const isInSubnet = require("is-in-subnet");
+const Logger = require("../../Logger");
+
+/**
+ *
+ * @param {object} req
+ * @param {object} res
+ * @param {Function} next
+ */
+module.exports = function checkExternalAccess(req, res, next) {
+    if (!isInSubnet.isPrivate(req.ip) && !isInSubnet.isLocalhost(req.ip)) {
+        Logger.warn(`Blocked external request to ${req.url} from ${req.ip}`);
+
+        res.status(401).send("External access to Valetudo is blocked.");
+    } else {
+        next();
+    }
+};

backend/lib/webserver/middlewares/index.js

@@ -1,5 +1,6 @@
 module.exports = {
     CSPMiddleware: require("./CSPMiddleware"),
+    ExternalAccessCheckMiddleware: require("./ExternalAccessCheckMiddleware"),
     ServerMiddleware: require("./ServerMiddleware"),
     VersionMiddleware: require("./VersionMiddleware")
 };

backend/package.json

@@ -46,6 +46,7 @@
     "express-dynamic-middleware": "1.0.0",
     "express-list-endpoints": "6.0.0",
     "express-rate-limit": "5.5.1",
+    "is-in-subnet": "4.0.1",
     "mqtt": "4.2.8",
     "nested-object-assign": "1.0.4",
     "nested-property": "4.0.0",