Sunil56224972 accb8983ca fix(security): add cross-site gate to military-installations proxy ...

The /api/military-installations endpoint was the last keyless proxy without
the admitSameSite gate that protects terrain, CCTV, traffic, places, and
Celestrak. A cross-site <img>, foreign Origin, opaque origin, or
reverse-proxy-forwarded request now receives 403 before any Overpass query.
Same-origin app requests and bare tool requests continue to work.

Adds 4 integration tests (cross-site refused, same-origin admitted,
bare tool admitted, proxied refused) following the terrainHeightsBounds
test pattern.

2026-10-27 18:21:53 +05:30

..

mcp

fix(mcp): serialize shared panel key repair and credit report

2026-10-07 15:12:44 -07:00

providers

fix(security): add cross-site gate to military-installations proxy

2026-10-27 18:21:53 +05:30

standalone

fix(maps): avoid 404 on keyless Google tiles-token probe (#1066)

2026-10-25 19:13:38 -07:00