Geocoding performed server-side at creation, not client-side with exposed key

A geocoding API key embedded in client-side JavaScript is visible to any user who opens DevTools — this is CWE-522 (Insufficiently Protected Credentials) and an OWASP A05:2021 (Security Misconfiguration) violation. Exposed keys can be harvested and used by third parties to run geocoding requests against your quota, resulting in unexpected billing spikes or service denial when you hit rate limits. For Google Maps API keys, quota theft has caused five-figure surprise bills. CWE-200 (Exposure of Sensitive Information) applies because the key itself represents privileged access to a paid API service.

Move all geocoding calls to a server-side API route. The client never receives the API key — it only calls your own backend endpoint.

// src/app/api/geocode/route.ts (Next.js App Router)
export async function POST(req: Request) {
  const { address } = await req.json();
  const apiKey = process.env.GOOGLE_GEOCODING_API_KEY; // server-only env var

  const res = await fetch(
    `https://maps.googleapis.com/maps/api/geocode/json?address=${encodeURIComponent(address)}&key=${apiKey}`
  );
  const data = await res.json();

  if (!data.results?.[0]) {
    return Response.json({ error: 'Address not found' }, { status: 400 });
  }

  const { lat, lng } = data.results[0].geometry.location;
  return Response.json({ lat, lng });
}

Ensure GOOGLE_GEOCODING_API_KEY is never prefixed with NEXT_PUBLIC_ — any NEXT_PUBLIC_ variable is bundled into client code. Compare with directory-map-location.geocoding.api-keys-restricted — server-side geocoding eliminates key exposure, but the key should still be restricted in Google Cloud Console.