Harden cookie authentication

server/api/auth/signout.post.ts

@@ -1,7 +1,13 @@
 import { deleteCookie } from "h3"
-import { REFRESH_COOKIE, SESSION_COOKIE } from "../../utils/auth"
+import {
+	assertCookieRequestOrigin,
+	defineAuthenticatedEventHandler,
+	REFRESH_COOKIE,
+	SESSION_COOKIE,
+} from "../../utils/auth"
 
-export default defineEventHandler((event) => {
+export default defineAuthenticatedEventHandler((event) => {
+	assertCookieRequestOrigin(event)
 	deleteCookie(event, REFRESH_COOKIE, { path: "/", sameSite: "lax", secure: !import.meta.dev })
 	deleteCookie(event, SESSION_COOKIE, { path: "/", sameSite: "lax", secure: !import.meta.dev })
 	return { success: true }