Sunilanddaikaginza c7ff33ac2e fix(server): admit reverse-proxied same-origin terrain requests ...

Review follow-up on #975. The shared same-site gate refuses any forwarding header, which is right for routes that spend a key, but terrain is keyless and needed for rendering: behind the reverse proxy the README documents, every /api/terrain/heights chunk got 403 and fell back to the geoid. Terrain now uses admitSameSiteKeyless, which keeps the Sec-Fetch-Site and exact-Origin checks (comparing Origin against a single X-Forwarded-Proto scheme) but does not refuse forwarding headers. The shared admitSameSite gate is unchanged for every other route. The changelog entry moves to changelog.d/975-terrain-cross-site-gate.md.

Co-authored-by: daikaginza <[email protected]>

2026-10-17 14:36:24 +05:30

..

mcp

fix(mcp): serialize shared panel key repair and credit report

2026-10-07 15:12:44 -07:00

providers

fix(server): admit reverse-proxied same-origin terrain requests

2026-10-17 14:36:24 +05:30

standalone

i18n: fix the LGTM review findings and tidy the branch texts

2026-10-16 21:00:28 +04:00