mirror of
https://github.com/bilawalsidhu/gods-eye-view.git
synced 2026-11-05 19:04:02 +00:00
Sunilanddaikaginza
c7ff33ac2e
Review follow-up on #975. The shared same-site gate refuses any forwarding header, which is right for routes that spend a key, but terrain is keyless and needed for rendering: behind the reverse proxy the README documents, every /api/terrain/heights chunk got 403 and fell back to the geoid. Terrain now uses admitSameSiteKeyless, which keeps the Sec-Fetch-Site and exact-Origin checks (comparing Origin against a single X-Forwarded-Proto scheme) but does not refuse forwarding headers. The shared admitSameSite gate is unchanged for every other route. The changelog entry moves to changelog.d/975-terrain-cross-site-gate.md. Co-authored-by: daikaginza <[email protected]>
9 lines
547 B
Markdown
9 lines
547 B
Markdown
- Cross-site pages can no longer fill the terrain-height cache or spend the
|
|
visitor's own `/api/terrain/heights` rate-limit quota through the visitor's
|
|
browser. The route refuses a cross-site `Sec-Fetch-Site` or a foreign or
|
|
opaque `Origin` before rate limiting, cache access or upstream work. Unlike
|
|
the cost-bearing routes it still answers same-origin requests that arrive
|
|
through a reverse proxy, so terrain keeps rendering behind nginx, Caddy or
|
|
Cloudflare instead of falling back to the geoid (Sunil56224972, daikaginza,
|
|
#975).
|