From 836a23d3d96b58f76f47d1b814fafe3b48b31813 Mon Sep 17 00:00:00 2001 From: anupamme Date: Wed, 9 Sep 2026 13:45:09 +0000 Subject: [PATCH] fix: V-001 security vulnerability Automated security fix generated by OrbisAI Security --- routes/wfs.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/routes/wfs.js b/routes/wfs.js index 9217a6f..17a2985 100644 --- a/routes/wfs.js +++ b/routes/wfs.js @@ -791,7 +791,11 @@ export const registerWfsRoutes = ({ getQueryCI(req, 'VERSION') || getQueryCI(req, 'version'), getQueryCI(req, 'ACCEPTVERSIONS') || getQueryCI(req, 'acceptversions') ); + // Prefer the API key from a request header (never logged/cached the way + // query strings are) and only fall back to query params for GIS clients + // (e.g. QGIS) that cannot send custom headers. const reqApiKey = String( + req.headers['x-api-key'] || getQueryCI(req, 'api_key') || getQueryCI(req, 'apikey') || getQueryCI(req, 'apiKey') ||