Fix Helmet's default no-referrer policy breaking /api/gmaps/key

[timothylee58]

Root cause

The user reported GET /api/gmaps/key returning 403 {"error":"Forbidden"} even when loaded from the real deployed page (confirmed via DevTools Network tab), not just via direct URL navigation. Their BASE_URL was already correctly configured.

The actual bug: Helmet defaults to Referrer-Policy: no-referrer when not explicitly configured. This tells the browser to omit the Referer header on every outgoing request from the page — including the same-origin fetch('/api/gmaps/key') call in app.js. Combined with browsers not reliably sending an Origin header on simple same-origin GET fetches, weatherProxyController.js's same-origin check had nothing to compare against and always returned 403 — completely independent of whether BASE_URL was correctly set (fixed in #30) or a scheme was present.

This explains why the 403 persisted after the #30 fix: that PR fixed the comparison logic, but the browser was never sending the header being compared in the first place.

Fix

Set referrerPolicy: { policy: 'strict-origin-when-cross-origin' } in the Helmet config — this is the browser's own default in the absence of any policy, and sends the full Referer on same-origin requests while still only sending the bare origin cross-origin (no privacy regression for third-party sites).

Verification

Ran the app locally with BASE_URL=slackbot-weather-production.up.railway.app (matching the user's real value):

• Referer: https://slackbot-weather-production.up.railway.app/ → 200 {"key":"test123"} ✅ (previously 403)
• No Referer/Origin at all → still 403 {"error":"Forbidden"} ✅ (security boundary intact)

Test plan

• npm test — 119/119 passing
• Manual curl verification against a running local instance (see above)

---

Generated by Claude Code

---

Note

Low Risk
Single Helmet header tweak aligned with common browser defaults; tightens referrers only relative to no-referrer while preserving the existing 403 when neither Origin nor Referer is sent.

Overview
Helmet was sending Referrer-Policy: no-referrer by default, so browsers dropped Referer on same-origin fetch('/api/gmaps/key'). The endpoint’s same-origin guard often has no Origin on simple GETs and falls back to Referer, so legitimate page loads kept returning 403 even with BASE_URL configured correctly.

The Helmet config now sets referrerPolicy: { policy: 'strict-origin-when-cross-origin' }, restoring full referrers on same-origin requests while keeping origin-only referrers cross-origin. Requests with neither header should still be rejected.

^{Reviewed by Cursor Bugbot for commit c53fa2b. Configure here.}

---

Summary by cubic

Fixes 403 responses from /api/gmaps/key by setting helmet’s referrer policy to allow the Referer header on same-origin requests. Restores the same-origin check without reducing cross-origin privacy.

• Bug Fixes
  • Set referrerPolicy: { policy: 'strict-origin-when-cross-origin' } in helmet.
  • Same-origin fetches now succeed; requests without Referer/Origin still return 403.

^{Written for commit c53fa2b. Summary will update on new commits.}

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3c458252-3444-4173-b4d0-1dd0cd2d44ee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_4cf631e7-bb06-4f84-a923-27c41727ec2f)

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.