mirror of
https://github.com/bilawalsidhu/gods-eye-view.git
synced 2026-11-04 02:14:01 +00:00
Sunilanddaikaginza
c7ff33ac2e
Review follow-up on #975. The shared same-site gate refuses any forwarding header, which is right for routes that spend a key, but terrain is keyless and needed for rendering: behind the reverse proxy the README documents, every /api/terrain/heights chunk got 403 and fell back to the geoid. Terrain now uses admitSameSiteKeyless, which keeps the Sec-Fetch-Site and exact-Origin checks (comparing Origin against a single X-Forwarded-Proto scheme) but does not refuse forwarding headers. The shared admitSameSite gate is unchanged for every other route. The changelog entry moves to changelog.d/975-terrain-cross-site-gate.md. Co-authored-by: daikaginza <[email protected]>
547 B
547 B
- Cross-site pages can no longer fill the terrain-height cache or spend the
visitor's own
/api/terrain/heightsrate-limit quota through the visitor's browser. The route refuses a cross-siteSec-Fetch-Siteor a foreign or opaqueOriginbefore rate limiting, cache access or upstream work. Unlike the cost-bearing routes it still answers same-origin requests that arrive through a reverse proxy, so terrain keeps rendering behind nginx, Caddy or Cloudflare instead of falling back to the geoid (Sunil56224972, daikaginza, #975).