Sep 16 - Optimize code, part 1

location_logging.py

@@ -1,7 +1,7 @@
 # File: location_logging.py
 # Enhanced location action logging for Android debugging
 
-from flask import request, jsonify
+from flask import request, jsonify, session
 from datetime import datetime
 import json
 import traceback
@@ -69,8 +69,12 @@ def create_location_logging_routes(app, db, logger_handler):
     @app.route('/api/location-debug-info', methods=['GET'])
     def get_location_debug_info():
         """
-        Get debugging information about location services
+        Get debugging information about location services (admins only)
         """
+        # Not public: it used to echo every request header to anyone, including
+        # the session Cookie, which would defeat HttpOnly if an XSS ever landed.
+        if session.get('role') != 'admin':
+            return jsonify({'error': 'Access denied'}), 403
         try:
             user_agent = request.headers.get('User-Agent', '')
             device_info = extract_device_info(user_agent)
@@ -79,7 +83,7 @@ def create_location_logging_routes(app, db, logger_handler):
                 'timestamp': datetime.now().isoformat(),
                 'ip_address': get_client_ip_enhanced(),
                 'device_info': device_info,
-                'headers': dict(request.headers),
+                # request headers are deliberately not echoed (they carry the session Cookie)
                 'is_android': 'android' in user_agent.lower(),
                 'is_chrome': 'chrome' in user_agent.lower() and 'edg' not in user_agent.lower(),
                 'is_secure': request.is_secure,