Travel Companion

A MERN map-review application for discovering places through short, location-aware community notes.

Features · Quick start · Architecture · Security · Limitations

What is it?

Travel Companion is a full-stack learning project that lets registered travellers explore a map, select a location, publish a short review, and read recent reviews left by the community. It combines a React and MapLibre interface with an Express API and MongoDB persistence.

The repository began as a hackathon project and is best treated as a portfolio-scale application rather than a production travel platform.

Features

• interactive MapLibre map with review markers and popups
• account registration and email/password login
• authenticated creation of geolocated reviews
• server-derived review authorship rather than client-supplied usernames
• public, bounded feed of the 100 most recent reviews
• rating and coordinate validation on both the interface and API boundary

Architecture

flowchart LR
    B[Browser] -->|register / login| A[Express API]
    A -->|JWT| B
    B -->|public review list| A
    B -->|authenticated review| A
    A --> M[(MongoDB)]
    B --> T[Carto basemap tiles]

Loading

client/   React interface, MapLibre map, session handling
server/   Express API, JWT authentication, review validation, Mongoose models

Quick start

Requirements: Node.js 20+, npm, and MongoDB.

API

cd server
cp .env.example .env
npm ci
npm start

Replace the example JWT_SECRET with at least 32 random characters. The API listens on 127.0.0.1:8113 by default.

Client

In another terminal:

cd client
cp .env.example .env
npm ci
npm start

Open http://localhost:3000, create an account, and use the map after signing in.

Configuration

Variable	Component	Purpose
MONGODB_URI	API	MongoDB connection string
JWT_SECRET	API	Token signing key; minimum 32 characters
CLIENT_ORIGINS	API	Comma-separated browser-origin allowlist
PORT, HOST	API	Network binding
REACT_APP_API_URL	Client	API base URL compiled into the React build

Populated .env files are ignored. Keep database credentials and signing keys outside source control.

Security baseline

• bcrypt password hashing and passwords excluded from normal database queries
• generic login failures that do not distinguish missing accounts from bad passwords
• short-lived JWTs with issuer and audience validation
• review creation protected by bearer-token authentication
• review ownership and displayed username derived from the verified JWT
• strict field lengths, integer rating bounds, geographic coordinate bounds, request size limits, and rate limiting
• Helmet headers, a configured CORS allowlist, and loopback binding by default
• browser sessions held in sessionStorage and cleared when expired

This is a baseline for a learning project, not a completed security assessment.

Limitations

• Reviews cannot yet be edited, deleted, reported, moderated, or paginated beyond the newest 100.
• The client token remains accessible to same-origin JavaScript; a production application should use a hardened session design.
• There is no email verification, password recovery, role model, accessibility audit, automated end-to-end coverage, or deployment configuration.
• Basemap availability and terms are controlled by the external tile provider.
• Historical database credentials must be rotated because removing a tracked .env file does not erase Git history.
• There is no license file; source availability does not grant permission to reuse the code.