From c53fa2b7250b86691b53461492a4d986d9bc3a71 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 3 Aug 2026 00:23:01 +0000 Subject: [PATCH] Fix Helmet's default no-referrer policy breaking /api/gmaps/key check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Helmet defaults to 'Referrer-Policy: no-referrer', which strips the Referer header from every outgoing request the page makes — including the same-origin fetch('/api/gmaps/key') call. Combined with browsers not reliably sending an Origin header on simple same-origin GET fetches, the backend's same-origin check in weatherProxyController.js always had nothing to compare against, so it 403'd unconditionally — even from the real page, regardless of BASE_URL correctness. Set referrerPolicy to 'strict-origin-when-cross-origin' (the browser's own default absent any CSP framework), which sends the full Referer on same-origin requests while still only sending the bare origin cross-origin. Verified locally: a same-origin Referer now correctly authorizes the request, while no Referer/Origin still correctly 403s. --- backend/app.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/backend/app.js b/backend/app.js index e2676423..f7eef14f 100644 --- a/backend/app.js +++ b/backend/app.js @@ -71,6 +71,12 @@ app.use(helmet({ }, }, crossOriginEmbedderPolicy: false, // Google Maps requires this to be off + // Helmet defaults to 'no-referrer', which strips the Referer header from + // every request the page makes — including same-origin fetches. That + // broke the same-origin check on GET /api/gmaps/key (it always 403'd, + // even from the real page). 'strict-origin-when-cross-origin' is the + // browser default: full URL on same-origin requests, origin-only cross-origin. + referrerPolicy: { policy: 'strict-origin-when-cross-origin' }, })); // ── Middleware ────────────────────────────────────────────────────────────────