Sunilanddaikaginza ff799d1520 fix(server): refuse cross-site requests on the terrain-heights route ...

Follow-up to #686 requested on #923. The route's per-client limiter keys on the socket address, which for a cross-site <img> is the visitor's own browser, so any web page could fill the bounded cache with junk keys and spend the visitor's 90/min quota, leaving the app's own terrain lookups on 429. Gate the route with admitSameSite before the limiter, like the Places routes.

Co-authored-by: daikaginza <[email protected]>

2026-10-08 21:13:16 +05:30

..

aircraft

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

cctv

fix: judge camera catalog trimming by region, not by returned cameras

2026-10-02 15:21:36 -07:00

common

fix(server): keep cost throttles on for positive fractional limits

2026-10-02 20:17:21 -07:00

military-installations

style: format extracted local services

2026-09-12 13:01:49 -07:00

openai

fix(server): keep debug-log timestamps server-owned and send nosniff

2026-10-02 20:00:11 -07:00

overpass

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

places

fix(server): gate Google text search against cross-site requests

2026-10-02 20:16:39 -07:00

radio

refactor: expose portable source record protocols

2026-09-14 19:36:32 -07:00

regional

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

space

fix: register data providers for local preview

2026-09-12 12:43:54 -07:00

vessels

feat: name live feed routes and sources for what they serve

2026-10-03 23:10:32 -07:00

wind

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

cctv.js

fix: say when the camera catalog serves only part of a region

2026-10-02 15:21:36 -07:00

cyclones.js

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

firePerimeters.js

feat(fires): MODIS in Active Fires and a Fire Perimeters layer (#737)

2026-09-23 21:21:52 -05:00

firms.js

feat(fires): MODIS in Active Fires and a Fire Perimeters layer (#737)

2026-09-23 21:21:52 -05:00

gbfs.js

fix(gbfs): adapt redirect hardening to provider modules and bound body reads

2026-09-12 15:13:14 -07:00

live.js

style: format extracted live provider modules

2026-09-11 19:06:10 -07:00

local-receivers.js

feat(sdr): local receivers — browser RTL-SDR, Local ADS-B layer and decoder feeds (#732)

2026-09-23 16:00:53 -05:00

local.js

feat: share the tool catalog with voice

2026-10-01 13:52:36 -07:00

military-installations.js

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

openai.js

fix(server): gate cost/log endpoints against cross-site requests and ship a full CSP

2026-10-02 19:56:42 -07:00

overpass.js

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

places.js

fix(server): throttle the cost-bearing proxies by default

2026-10-02 19:57:29 -07:00

radio.js

style: adopt formatting for CCTV and radio provider modules

2026-09-12 12:09:04 -07:00

regional.js

feat(search): Nominatim as the last-resort geocoder (#573)

2026-09-14 21:22:08 -05:00

space.js

style: format satellite and launch provider modules

2026-09-11 21:22:41 -07:00

terrain.js

fix(server): refuse cross-site requests on the terrain-heights route

2026-10-08 21:13:16 +05:30

traffic.js

fix(tomtom): size the daily tile budget to the real free allowance

2026-09-19 22:44:19 -07:00

transit.js

refactor: separate transit sources and request service

2026-09-15 07:41:56 -07:00

transitHistory.js

refactor: separate transit sources and request service

2026-09-15 07:41:56 -07:00

transitHistory.test.mjs

feat(transit): live public-transit vehicles from open GTFS-Realtime feeds (#587)

2026-09-15 05:18:30 -05:00

weather.js

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

wind.js

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00