update

README.md

@@ -1,19 +1,18 @@
-## OpenAI API Proxy Service Supporting Organization ID
+## Protect your OpenAI Key: Proxy Service with API Firewall
 
 <a href="./README.md">English</a> |
 <a href="./README_cn.md">中文</a>
 
-Currently, most programs accessing the OpenAI API do not support the Organization ID. This project converts custom keys into OpenAI_API_Key + OpenAI_Org_ID for compatibility with the vast majority of OpenAI API programs.
-
-
 ### Features:
 1. Create multiple personal API keys to protect your OpenAI key from being leaked.
 
-2. Your personal API keys can be tied to an Organization ID.
+2. Only APIs related to GPT Chat are allowed to pass, in order to prevent hackers from accessing account privacy information using undisclosed API interfaces.
+
+3. Support for Organization ID is provided, which allows customized KEYs to be converted to OpenAI_API_Key + OpenAI_Org_ID for compatibility with the vast majority of OpenAI API programs.
 
-3. Compatible with <a href="https://github.com/Yidadaa/ChatGPT-Next-Web">ChatGPT Next Web</a>, <a href="https://github.com/mckaywrigley/chatbot-ui">chatbot-ui</a>, <a href="https://github.com/Chanzhaoyu/chatgpt-web">chatgpt-web</a>, OpenCat, and other projects.
+4. Compatible with <a href="https://github.com/Yidadaa/ChatGPT-Next-Web">ChatGPT Next Web</a>, <a href="https://github.com/mckaywrigley/chatbot-ui">chatbot-ui</a>, <a href="https://github.com/Chanzhaoyu/chatgpt-web">chatgpt-web</a>, OpenCat, and other projects.
 
-4. Supports OpenAI's streaming output for a better user experience.
+5. Supports OpenAI's streaming output for a better user experience.
 
 
 ### Deployment Steps:

README_cn.md

@@ -1,19 +1,18 @@
-## 支持 Organization ID 的 OpenAI API 转接服务
+## OpenAI API 转接防火墙保护服务
 
 <a href="./README.md">English</a> |
 <a href="./README_cn.md">中文</a>
 
-目前，大多数接入OpenAI API程序都不支持Organization ID。这个项目是将自定义的KEY转换成OpenAI_API_Key + OpenAI_Org_ID，以兼容绝大多数的OpenAI API程序。
-
-
 ### 特点：
-1. 建立多个自己的API KEY，保护OpenAI KEY不泄露
+1. 能创建多个自定义API KEY，保护OpenAI KEY不泄露
 
-2. 自己的API KEY能绑定Organization ID
+2. 只放行与GPT Chat相关的接口，避免黑客使用未公开的API接口获取帐号隐私信息
+
+3. 支持Organization ID，可以将自定义的KEY转换成OpenAI_API_Key + OpenAI_Org_ID，以兼容绝大多数的OpenAI API程序
 
-3. 兼容<a href="https://github.com/Yidadaa/ChatGPT-Next-Web">ChatGPT Next Web</a>、<a href="https://github.com/mckaywrigley/chatbot-ui">chatbot-ui</a>、<a href="https://github.com/Chanzhaoyu/chatgpt-web">chatgpt-web</a>、OpenCat等项目
+4. 兼容<a href="https://github.com/Yidadaa/ChatGPT-Next-Web">ChatGPT Next Web</a>、<a href="https://github.com/mckaywrigley/chatbot-ui">chatbot-ui</a>、<a href="https://github.com/Chanzhaoyu/chatgpt-web">chatgpt-web</a>、OpenCat等项目
 
-3. 支持OpenAI的流输出，体验佳
+5. 支持OpenAI的流输出，体验佳
 
 
 ### 部署步骤：

worker.js

@@ -7,6 +7,13 @@ const subKey = {
     'security-key-2': ['sk-Cf***', null]
 };
 
+const validPaths = [
+    '/v1/models',
+    '/v1/chat/completions',
+    '/dashboard/billing/usage',
+    '/dashboard/billing/subscription',
+];
+
 const enable_forwarding_OpenAI_Key = false;
 
 addEventListener('fetch', event => {
@@ -54,9 +61,13 @@ async function handleRequest(request) {
         body: request.body,
         redirect: request.redirect,
     })
+
+    let chkVaildPath = true;
+    console.log('url:', url.pathname);
     const authHeader = newRequest.headers.get('Authorization');
     if (enable_forwarding_OpenAI_Key && authHeader && authHeader.startsWith('Bearer sk-')) {
         // Forwarding Openai API Key
+        chkVaildPath = false;
     }
     else if (authHeader && authHeader.startsWith('Bearer ')) {
         const authKey = authHeader.replace('Bearer ', '');
@@ -71,6 +82,10 @@ async function handleRequest(request) {
         return new Response('{"error": {"message": "Missing API key","type": "invalid_request_error"}}\n', { status: 401 });
     }
 
+    if (chkVaildPath && !validPaths.some(prefix => url.pathname.startsWith(prefix))) {
+        return new Response('{"error": {"message": "API Error","type": "invalid_request_error"}}\n', { status: 401 });
+    }
+
     const response = await fetch(newRequest, { cf: { stream: true } });
     const newResponse = new Response(response.body, response);
     newResponse.headers.set('Content-Length', response.headers.get('Content-Length'));