From c643cbb3e764ec19a2c7bf0bae8dd61cd7ad6c67 Mon Sep 17 00:00:00 2001
From: Viren070 <viren070@protonmail.com>
Date: Fri, 8 Aug 2025 22:00:14 +0100
Subject: [PATCH] fix: block head requests on debrid resolve and add missing
 return

---
 packages/server/src/routes/api/debrid.ts | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/packages/server/src/routes/api/debrid.ts b/packages/server/src/routes/api/debrid.ts
index a5d45bba..10649a94 100644
--- a/packages/server/src/routes/api/debrid.ts
+++ b/packages/server/src/routes/api/debrid.ts
@@ -26,6 +26,15 @@ import {
 const router = Router();
 const logger = createLogger('server');
 
+// block HEAD requests
+router.use((req: Request, res: Response, next: NextFunction) => {
+  if (req.method === 'HEAD') {
+    res.status(405).send('Method not allowed');
+  } else {
+    next();
+  }
+});
+
 router.get(
   '/resolve/:encodedStoreAuth/:encodedPlaybackInfo/:filename',
   async (req: Request, res: Response, next: NextFunction) => {
@@ -97,6 +106,7 @@ router.get(
         }
 
         res.status(302).redirect(`/static/${staticFile}`);
+        return;
       }
 
       if (!streamUrl) {