Main - #33
Merged
Merged
Conversation
The Origin/Referer check previously used raw string prefix matching against BASE_URL, so a BASE_URL set without a scheme (e.g. 'example.up.railway.app' instead of 'https://example.up.railway.app') would never match a browser's 'https://example.up.railway.app' Origin header, causing every request to 403 — this is exactly what happened on the live Railway deployment. Now parses both BASE_URL and the incoming Origin/Referer into hostnames via the URL constructor (defaulting to https:// when no scheme is present) and compares hostnames instead of raw strings, so scheme mismatches and trailing slashes no longer break the check. Added backend/__tests__/controllers/weatherProxyController.test.js covering: no key configured, no BASE_URL (dev mode), matching origin, scheme-less BASE_URL, Referer fallback, trailing slash, and 403 cases.
Make /api/gmaps/key origin check tolerant of scheme-less BASE_URL
fetch() never rejects on non-2xx status, so 'r.json()' on a 403 (Forbidden — origin mismatch) or 503 (key not configured) response silently parsed the error body without checking r.ok. The catch block then always logged the same generic 'No Google Maps API key returned' regardless of the real cause, making it impossible to diagnose from the browser console alone. Now checks r.ok/r.status and surfaces the actual error message and HTTP status in both the console error and the on-page banner.
Surface real /api/gmaps/key error status on the frontend
Helmet defaults to 'Referrer-Policy: no-referrer', which strips the
Referer header from every outgoing request the page makes — including
the same-origin fetch('/api/gmaps/key') call. Combined with browsers
not reliably sending an Origin header on simple same-origin GET fetches,
the backend's same-origin check in weatherProxyController.js always had
nothing to compare against, so it 403'd unconditionally — even from the
real page, regardless of BASE_URL correctness.
Set referrerPolicy to 'strict-origin-when-cross-origin' (the browser's
own default absent any CSP framework), which sends the full Referer on
same-origin requests while still only sending the bare origin
cross-origin. Verified locally: a same-origin Referer now correctly
authorizes the request, while no Referer/Origin still correctly 403s.
Fix Helmet's default no-referrer policy breaking /api/gmaps/key
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_e0d59c72-0694-4d2e-8021-22dd5760d666) |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
📝 WalkthroughWalkthroughChangesGoogle Maps key flow
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: ✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Medium Risk
Touches API key exposure rules and security headers; behavior is tightened to hostname equality but still gates on Origin/Referer when BASE_URL is set.
Overview
Fixes Google Maps failing to load when the app fetches
GET /api/gmaps/key: Helmet’s defaultno-referrerstrippedReferer, so the same-origin guard always returned 403 even from the real site. SetsreferrerPolicy: strict-origin-when-cross-originso same-origin requests still send a usableReferer.Same-origin validation on
getGoogleMapsKeyno longer uses string prefix checks onBASE_URL. It compares hostnames via a newtoHostname()helper (missinghttps://, trailing slashes,Originvs fullRefererURLs). The client now surfaces HTTP status and API error text when key fetch fails.Adds Jest coverage for 503/403/200 paths and the misconfiguration cases above.
Reviewed by Cursor Bugbot for commit 1b9bd3c. Configure here.
Summary by cubic
Fixes 403s when loading Google Maps by making the
/api/gmaps/keysame-origin check robust and keeping the Referer header. Also surfaces real errors on the frontend and adds tests to prevent regressions.BASE_URL, tolerating scheme-lessBASE_URLand trailing slashes; fallback to Referer when Origin is missing.helmetreferrerPolicy tostrict-origin-when-cross-originso same-origin fetches send a Referer.response.ok/statusand shows the actual error (e.g., 403/503) when the key request fails.getGoogleMapsKeycovering no key, dev mode, matching origin, scheme-lessBASE_URL, Referer fallback, trailing slash, and 403 cases.Written for commit 1b9bd3c. Summary will update on new commits.
Summary by CodeRabbit
Bug Fixes
Tests