From 585392cbcfc055ba8412a8ddd85b69a587f0acd0 Mon Sep 17 00:00:00 2001
From: Sameh Khamis <sameh@halfpixel.ai>
Date: Tue, 3 Nov 2026 14:35:14 -0800
Subject: [PATCH] fix(drone-airspace): refuse cross-site requests to the FAA
 proxy

A foreign Origin or Sec-Fetch-Site: cross-site request was answered and
counted against the client's 60-a-minute quota, and could start a refresh.
Run the keyless same-site checks the other map routes use before rate
limiting and cache acquisition; reverse-proxy forwarding headers stay
accepted. List the route with the keyless map routes in SECURITY.md.
---
 SECURITY.md                          |  2 +-
 docs/CURRENT-STATE.md                |  5 ++-
 server/providers/droneAirspace.js    |  5 +++
 src/data/droneAirspaceProxy.test.mjs | 59 +++++++++++++++++++++++++++-
 4 files changed, 67 insertions(+), 4 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index 2527004fb..01abdbac0 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -81,7 +81,7 @@ The data proxies under `server/providers/` are written so the browser cannot tur
 - **Sanitized errors** — internal error details are not echoed back to clients.
 - **Coalesced OAuth refresh** and cached successful responses only (OpenSky).
 - **Redacted debug logging.** The voice debug log (`.gev-logs/`, gitignored) strips API keys, bearer tokens, client secrets, and image data URLs before writing.
-- **Cross-site gate on cost/log endpoints.** The cost-bearing (`/api/realtime/token`, `/api/openai/hud-summary`, `/api/google/nearby-places`, `/api/google/text-search`), quota-bearing (`/api/mapillary/*`, with a per-IP limit on tiles, and `/api/tomtom/*`, backed by its persistent daily tile budget) and log (`/api/realtime/debug-log`) endpoints refuse cross-site browser requests: a foreign or opaque `Origin`, a `Sec-Fetch-Site` other than `same-origin`/`none` (this is what blocks an `<img>`/navigation that carries no `Origin`), or any reverse-proxy/CDN forwarding header returns `403`. Non-browser loopback tools (the repo QA harnesses POST the token endpoint with no `Origin`) and the explicit `HOST=0.0.0.0` LAN opt-in keep working — the gate deliberately does not require a loopback remote address; that stricter requirement belongs only to the credential panel (`admitKeySetupRequest`). The Host check (`allowedHosts`, applied by `hostCheckPlugin` ahead of every route, since Vite's own check runs only after plugin middleware) rejects a rebinding `Host` before any handler runs, in every mode, and the gate is defense in depth behind it: the LAN opt-in keeps that check and accepts only IP addresses, `localhost` and names listed in `GEV_ALLOWED_HOSTS`. **Limit:** a name you list there is trusted like the app's own address, so list only names you control. The keyless map routes (`/api/terrain/heights`, `/api/overpass` and voice place search's `/api/osm/features`, which spends the same operator Overpass) use the same cross-site checks, minus the forwarding-header refusal: they guard only per-client quotas and caches, not a key or a bill, and the map and voice need them to work behind a reverse proxy. `/api/overpass` also admits at most 300 POSTs a minute per peer (IPv6 peers keyed by /64) and 900 a minute across all remote peers before it reads a body. A direct loopback request — a loopback socket with none of the forwarding headers `hasProxySignals` checks (`Forwarded`, `Via`, `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Port`, `X-Forwarded-Proto`, `X-Real-IP`, `CF-Connecting-IP`, `CF-Ray`) — draws on its own per-peer admission window, so remote peers cannot exhaust the owner's admission. A reverse proxy on the same machine must add at least one of those headers (Caddy and Cloudflare do by default; nginx needs `proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`, plus `proxy_set_header Host $http_host;` and `proxy_set_header X-Forwarded-Proto $scheme;` so the `Origin` check matches), or its traffic is indistinguishable from the owner's and shares the owner's window. With one, its requests are then counted as remote, in one bucket per proxy socket — the forwarded client address is never trusted as identity — so all users behind one proxy share 300/min. The isolation needs a loopback socket: under the default Docker bridge network every host-side client, the owner included, arrives from the container gateway and is one remote peer. **Limit:** this isolates admission only. The upstream budget (90 requests/min per client key, 300/min across all clients) is shared, so once remote traffic has used the global upstream budget, an owner request that misses the cache can still get `429`, or `503` when remote misses hold every upstream concurrency slot; cache hits are unaffected. The CCTV routes (`/api/cctv/*`) use the same keyless checks; their one key-bearing step, the Street View fallback, is skipped for any request with forwarding headers.
+- **Cross-site gate on cost/log endpoints.** The cost-bearing (`/api/realtime/token`, `/api/openai/hud-summary`, `/api/google/nearby-places`, `/api/google/text-search`), quota-bearing (`/api/mapillary/*`, with a per-IP limit on tiles, and `/api/tomtom/*`, backed by its persistent daily tile budget) and log (`/api/realtime/debug-log`) endpoints refuse cross-site browser requests: a foreign or opaque `Origin`, a `Sec-Fetch-Site` other than `same-origin`/`none` (this is what blocks an `<img>`/navigation that carries no `Origin`), or any reverse-proxy/CDN forwarding header returns `403`. Non-browser loopback tools (the repo QA harnesses POST the token endpoint with no `Origin`) and the explicit `HOST=0.0.0.0` LAN opt-in keep working — the gate deliberately does not require a loopback remote address; that stricter requirement belongs only to the credential panel (`admitKeySetupRequest`). The Host check (`allowedHosts`, applied by `hostCheckPlugin` ahead of every route, since Vite's own check runs only after plugin middleware) rejects a rebinding `Host` before any handler runs, in every mode, and the gate is defense in depth behind it: the LAN opt-in keeps that check and accepts only IP addresses, `localhost` and names listed in `GEV_ALLOWED_HOSTS`. **Limit:** a name you list there is trusted like the app's own address, so list only names you control. The keyless map routes (`/api/terrain/heights`, `/api/drone-airspace`, `/api/overpass` and voice place search's `/api/osm/features`, which spends the same operator Overpass) use the same cross-site checks, minus the forwarding-header refusal: they guard only per-client quotas and caches, not a key or a bill, and the map and voice need them to work behind a reverse proxy. `/api/overpass` also admits at most 300 POSTs a minute per peer (IPv6 peers keyed by /64) and 900 a minute across all remote peers before it reads a body. A direct loopback request — a loopback socket with none of the forwarding headers `hasProxySignals` checks (`Forwarded`, `Via`, `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Port`, `X-Forwarded-Proto`, `X-Real-IP`, `CF-Connecting-IP`, `CF-Ray`) — draws on its own per-peer admission window, so remote peers cannot exhaust the owner's admission. A reverse proxy on the same machine must add at least one of those headers (Caddy and Cloudflare do by default; nginx needs `proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`, plus `proxy_set_header Host $http_host;` and `proxy_set_header X-Forwarded-Proto $scheme;` so the `Origin` check matches), or its traffic is indistinguishable from the owner's and shares the owner's window. With one, its requests are then counted as remote, in one bucket per proxy socket — the forwarded client address is never trusted as identity — so all users behind one proxy share 300/min. The isolation needs a loopback socket: under the default Docker bridge network every host-side client, the owner included, arrives from the container gateway and is one remote peer. **Limit:** this isolates admission only. The upstream budget (90 requests/min per client key, 300/min across all clients) is shared, so once remote traffic has used the global upstream budget, an owner request that misses the cache can still get `429`, or `503` when remote misses hold every upstream concurrency slot; cache hits are unaffected. The CCTV routes (`/api/cctv/*`) use the same keyless checks; their one key-bearing step, the Street View fallback, is skipped for any request with forwarding headers.
 - **Full Content-Security-Policy.** The dev and preview servers send a real CSP (`script-src 'self' 'unsafe-eval' blob:` plus the YouTube, Facebook and X scripts the Nepal event's embedded media loads and the Maps JavaScript API that Street View runs on, with a matching `frame-src` for their players and posts: no inline script and no other script origin; `blob:` covers the object URLs Cesium's bundled workers bootstrap through in the built app), alongside the existing `X-Frame-Options: DENY` and `frame-ancestors 'none'`. `'unsafe-eval'` stays because Knockout, bundled inside Cesium's widgets package, resolves the global object with `eval` at load time and the globe does not initialize without it; styles permit `'unsafe-inline'` and Google Fonts because Vite's dev client injects `<style>` elements.
 
 Allowing `maps.googleapis.com` in `script-src` also trusts its JSONP endpoints, which can bypass the script allowlist if an HTML-injection bug exists; this is an accepted limitation of loading the Maps JavaScript API, alongside the existing `'unsafe-eval'` allowance.
diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 5b37341cb..fc327bfc6 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -4103,7 +4103,10 @@ FeatureServer, caps the body, and reuses a one-hour snapshot, serving the last
 good payload as stale for at most 24 hours when a refresh fails; the layer row
 then reads STALE, dated by that snapshot's fetch. An answer with no valid zone, or
 paging that ends while the service still flags more records, counts as a
-failed refresh. Client-supplied URLs are rejected.
+failed refresh. Client-supplied URLs are ignored. The route uses the keyless
+same-site checks: a cross-site browser request gets `403` before it spends the
+per-client quota or starts a refresh, and the app still works behind a reverse
+proxy.
 Polygons keep holes; pick ownership is deliberately unregistered so sibling
 cards still work over a zone. The row legend and selected card state that the
 layer is informational only and not a substitute for B4UFLY / LAANC.
diff --git a/server/providers/droneAirspace.js b/server/providers/droneAirspace.js
index 7d9ead55c..72710dca2 100644
--- a/server/providers/droneAirspace.js
+++ b/server/providers/droneAirspace.js
@@ -1,6 +1,7 @@
 import { normalizeDroneAirspaceSnapshot } from '../../src/layers/droneAirspace/records.js';
 import { readResponseJsonCapped, coalesceProxyRequest } from './common/http.js';
 import { makeRateLimiter, clientKey } from './common/rate-limit.js';
+import { admitSameSiteKeyless } from './common/same-site.js';
 
 // FAA Special Use Airspace (public, keyless). TYPE_CODE P (prohibited) and
 // R (restricted) only — the small, always-in-force slice of the national
@@ -121,6 +122,10 @@ export function droneAirspaceProxy({
       });
       res.end(JSON.stringify(value));
     };
+    // Keyless and needed to render the layer: refuse cross-site browsers
+    // before they spend a client's quota or start a refresh, but keep the
+    // documented reverse-proxy deployment working.
+    if (admitSameSiteKeyless(req, res)) return;
     if (req.method !== 'GET') return json(405, { error: 'method_not_allowed' });
     const path = (req.url || '/').split('?')[0];
     if (path !== '/' && path !== '')
diff --git a/src/data/droneAirspaceProxy.test.mjs b/src/data/droneAirspaceProxy.test.mjs
index 52444cda0..208b969f5 100644
--- a/src/data/droneAirspaceProxy.test.mjs
+++ b/src/data/droneAirspaceProxy.test.mjs
@@ -35,17 +35,25 @@ function install(options = {}, hook = 'configureServer') {
       },
     },
   });
-  return async (url = '/', method = 'GET', peer = 'local') => {
+  return async (url = '/', method = 'GET', peer = 'local', headers = {}) => {
     const res = {
+      headers: {},
       writeHead(status, headers) {
         this.status = status;
         this.headers = headers;
       },
+      setHeader(name, value) {
+        this.headers[name] = value;
+      },
       end(body) {
+        this.status ??= this.statusCode;
         this.body = JSON.parse(body);
       },
     };
-    await handler({ url, method, socket: { remoteAddress: peer } }, res);
+    await handler(
+      { url, method, headers, socket: { remoteAddress: peer } },
+      res,
+    );
     return res;
   };
 }
@@ -235,3 +243,50 @@ test('a stale snapshot is served for at most a day, then refused', async () => {
   now += 2 * 60 * 60 * 1000;
   assert.equal((await request()).status, 502, 'a day-old snapshot is refused');
 });
+
+test('a cross-site page is refused before it spends quota or reaches FAA', async () => {
+  let fetches = 0;
+  const request = install({
+    fetchImpl: async () => {
+      fetches += 1;
+      return Response.json({ features: [feature()] });
+    },
+  });
+  const host = 'localhost:5173';
+  const refused = [
+    { host, 'sec-fetch-site': 'cross-site' },
+    { host, origin: 'https://evil.example' },
+    { host, origin: 'https://evil.example', 'sec-fetch-site': 'cross-site' },
+    { host, 'x-forwarded-for': '203.0.113.9', 'sec-fetch-site': 'cross-site' },
+  ];
+  // More refusals than the 60/min per-client quota, all from one peer.
+  for (let i = 0; i < 64; i++) {
+    const headers = refused[i % refused.length];
+    const res = await request('/', 'GET', '10.0.0.5', headers);
+    assert.equal(res.status, 403, JSON.stringify(headers));
+  }
+  assert.equal(fetches, 0, 'refusals cost no upstream call');
+  const app = await request('/', 'GET', '10.0.0.5', {
+    host,
+    origin: `http://${host}`,
+    'sec-fetch-site': 'same-origin',
+  });
+  assert.equal(app.status, 200, 'the app keeps its full quota');
+  assert.equal(fetches, 1);
+});
+
+test('the app served behind a reverse proxy still gets the zones', async () => {
+  const request = install({
+    fetchImpl: async () => Response.json({ features: [feature()] }),
+  });
+  const host = 'gev.example.com';
+  const res = await request('/', 'GET', '127.0.0.1', {
+    host,
+    origin: `https://${host}`,
+    'sec-fetch-site': 'same-origin',
+    'x-forwarded-for': '203.0.113.9',
+    'x-forwarded-proto': 'https',
+  });
+  assert.equal(res.status, 200);
+  assert.equal(res.body.rows.length, 1);
+});