fix(bikeshare): address the GBFS proxy by path, not query string (#569)

Supersedes #441 by @MiguelGFerreira, ported onto the current component layout with fixes from review.

Verified before merge: format, package boundaries, unit suite, build, and the browser tracking suite; a browser harness for the change where one applies; adversarial review applied.

Co-authored-by: MiguelGFerreira <[email protected]>
This commit is contained in:
Bilawal SidhuandMiguelGFerreira authored and GitHub committed 2026-09-14 21:08:12 -05:00
1 parent 96a6b49477
commit 2b0fcd4595
6 files changed
+312 -4

No files matched your search

+3 -1
View File
@@ -466,7 +466,9 @@ The existing declared media size ceiling remains 64 MiB.
## GBFS upstream bounds
GBFS refuses upstream redirects and enforces its 5 MiB response cap while
The station reader addresses the proxy as `/api/gbfs/<encoded feed URL>`; the
feed address is read from the path, and a query-string form is refused with a
400. GBFS refuses upstream redirects and enforces its 5 MiB response cap while
streaming. The 12-second deadline includes reading the body, and rejected or
stalled downloads are cancelled. Development and preview use the same handler.