From 84d9f2483eee463e631a933351e59cc347af4769 Mon Sep 17 00:00:00 2001
From: Christian Beutel <>
Date: Sun, 5 Oct 2025 12:42:20 +0200
Subject: [PATCH] block external profiles for unregistered users

---
 web/src/routes/api/v1/profile/[handle]/+server.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/web/src/routes/api/v1/profile/[handle]/+server.ts b/web/src/routes/api/v1/profile/[handle]/+server.ts
index 7573f5ee..a9772f26 100644
--- a/web/src/routes/api/v1/profile/[handle]/+server.ts
+++ b/web/src/routes/api/v1/profile/[handle]/+server.ts
@@ -1,4 +1,6 @@
+import { env } from '$env/dynamic/private';
 import type { Profile } from '$lib/models/profile';
+import { splitUsername } from '$lib/util/activitypub_util';
 import { handleError } from '$lib/util/api_util';
 import { error, json, type RequestEvent } from '@sveltejs/kit';
 
@@ -8,6 +10,10 @@ export async function GET(event: RequestEvent) {
         return error(400, { message: "Bad request" })
     }
 
+    if(splitUsername(handle)[1] !== env.ORIGIN && !event.locals.user) {
+        return error(401, { message: "Unauthorized" })
+    }
+
     try {
         const { actor, error } = await event.locals.pb.send(`/activitypub/actor?resource=acct:${handle}&follows=true`, { method: "GET", fetch: event.fetch, });