Make /api/gmaps/key origin check tolerant of scheme-less BASE_URL

[timothylee58]

Summary

Root-caused the 403 on GET /api/gmaps/key on the live Railway deployment: BASE_URL was set to slackbot-weather-production.up.railway.app (no https:// scheme). The old check did raw string prefix matching:

const allowed = baseUrl.replace(/\/$/, '');
const fromSameOrigin = origin.startsWith(allowed) || referer.startsWith(allowed);

A browser's Origin: https://slackbot-weather-production.up.railway.app header does not start with the bare hostname slackbot-weather-production.up.railway.app, so every request was rejected — the map page couldn't load a key at all.

Fix

weatherProxyController.js now parses both BASE_URL and the incoming Origin/Referer into hostnames via the URL constructor (defaulting to https:// when no scheme is present) and compares hostnames instead of raw strings. This makes the check tolerant of:

• missing scheme in BASE_URL (the actual bug hit in production)
• trailing slash on BASE_URL
• scheme case differences

Tests

Added backend/__tests__/controllers/weatherProxyController.test.js (8 new tests) covering: no key configured, no BASE_URL (dev mode passthrough), matching origin, scheme-less BASE_URL (regression test for the exact production bug), Referer fallback, trailing slash, and both 403 cases (mismatched host, missing headers).

Test plan

• npm test — 119/119 passing (111 existing + 8 new)
• Manually started the server with BASE_URL=slackbot-weather-production.up.railway.app (no scheme, matching the real deployment's misconfigured value) and confirmed curl -H "Origin: https://slackbot-weather-production.up.railway.app" now returns 200 with the key, while a mismatched origin still returns 403

Note

The user should still fix their Railway BASE_URL env var to include the https:// scheme going forward (also used by slackService.js's "View Live Map" Slack link) — this PR makes the code resilient to that misconfiguration but doesn't replace fixing the env var.

---

Generated by Claude Code

---

Note

Medium Risk
Touches access control for exposing the Google Maps API key; behavior is tightened to hostname equality but is slightly more permissive for scheme-less BASE_URL misconfiguration.

Overview
Fixes 403 on GET /api/gmaps/key when BASE_URL is set without a scheme (e.g. bare Railway hostname), which broke prefix matching against browser Origin: https://... headers.

getGoogleMapsKey now normalizes BASE_URL, Origin, and Referer to lowercase hostnames (defaulting missing schemes to https://) instead of startsWith on raw strings. Same-origin still uses Origin or Referer; dev mode with no BASE_URL is unchanged.

Adds weatherProxyController.test.js with eight cases: missing key, dev passthrough, matching origin, scheme-less BASE_URL, Referer fallback, trailing slash, and two 403 paths.

^{Reviewed by Cursor Bugbot for commit b001116. Configure here.}

---

Summary by cubic

Fixes 403s on GET /api/gmaps/key by comparing hostnames instead of raw strings, making the origin check tolerant of a scheme-less BASE_URL. Restores key loading on the Railway deployment.

• Bug Fixes
  • Parse BASE_URL, Origin, and Referer into hostnames (default https when missing) and compare equality.
  • Handles missing scheme, trailing slash, and case differences; falls back to Referer; skips check when BASE_URL is unset.
  • Added tests covering dev mode, scheme-less BASE_URL, Referer fallback, trailing slash, and 403 cases.

^{Written for commit b001116. Summary will update on new commits.}

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5cb4e56e-45e5-4d9d-b5bd-a1f7589723c4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ff9b37f1-9bed-4626-bf49-fc3d68f69d44)

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.