Fix OpenStreetMap "403 Referer required" tiles on admin maps - #1722
Open
qudiqudi wants to merge 1 commit into
Open
Fix OpenStreetMap "403 Referer required" tiles on admin maps#1722qudiqudi wants to merge 1 commit into
qudiqudi wants to merge 1 commit into
Conversation
OSM now enforces their tile usage policy and returns the "403r Access
blocked - Referer is required" placeholder for tile requests without an
acceptable Referer header. The admin maps create the OSM layer with a
bare L.tileLayer and no referrerPolicy, so the browser may send no
Referer and OSM blocks the tiles.
Set referrerPolicy: 'strict-origin-when-cross-origin' on the OSM tile
layer (the value OSM recommends, and the modern browser default) and
drop the deprecated {s}. subdomain. Applied to index.php, geoadd.php
and geofencing.php. OpenTopoMap and the Esri satellite layers use other
tile servers and are unchanged.
Refs: https://wiki.openstreetmap.org/wiki/Referer
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
qudiqudi
force-pushed
the
fix/osm-tile-referrer-policy
branch
from
June 6, 2026 14:40
2abf5bc to
fd4ebf7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The default OpenStreetMap layer on the admin maps renders every tile as OSM's "403r Access blocked - Referer is required" placeholder.
OSM now enforces their tile usage policy and rejects tile requests that arrive without an acceptable Referer header (https://wiki.openstreetmap.org/wiki/Referer). The admin maps create the OSM layer with a bare
L.tileLayerand noreferrerPolicy, so depending on the page's referrer policy the browser sends no Referer and OSM blocks the request.This sets
referrerPolicy: 'strict-origin-when-cross-origin'on the OSM tile layer (the value OSM recommends, and the modern browser default) so the origin is sent as the Referer. It also drops the deprecated{s}.subdomain in favour of the baretile.openstreetmap.orghost.Applied to the three admin pages that define an OSM layer:
index.php,geoadd.php,geofencing.php. OpenTopoMap and the Esri satellite layer use different tile servers and are unaffected.Refs:
AI-assisted contribution
This change was developed with AI-assisted coding using Claude Code (Opus 4.8). The model traced the root cause, identified all three affected admin pages, and produced the patch; a human reviewed and verified the diff before opening this PR. Flagging it for transparency so maintainers know how it was authored.