From 3177e70e677a9b63113fbfe7ea15f586bcc221d5 Mon Sep 17 00:00:00 2001 From: tiennm99 Date: Sun, 30 Aug 2026 20:52:11 +0700 Subject: [PATCH] fix(api): stop sending the panorama id to the client Prevents exposure of internal panorama IDs to the client, maintaining security boundaries and avoiding client-side dependency on server state. --- src/app/api/new-game/route.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/app/api/new-game/route.js b/src/app/api/new-game/route.js index 9daf661..ed83036 100644 --- a/src/app/api/new-game/route.js +++ b/src/app/api/new-game/route.js @@ -71,8 +71,9 @@ export async function GET(request) { sessionId: currentSessionId, // Built from the picked region only -- never from the resolved district. region: publicRegion(pickedRegion), + // The pano id stays server-side in the session: with it a player could + // look the panorama up on Mapillary and read the answer coordinates. imageData: { - id: selectedImage.id, url: imageUrl, isPano: selectedImage.isPano }