csp

lesson

openstreetmap maps csp sandbox referrer-policy maplibre

498 tok

When embedding a map library (e.g., Leaflet, MapLibre) in a sandbox-isolated iframe, browser requests to OpenStreetMap tile endpoints are silently blocked

tile.openstreetmap.org returns a 200 'Access blocked' PNG (osm.wiki/Blocked) to browser requests with no Referer. A document under CSP sandbox (or iframe sandbox without allow-same-origin) has an opaque origin and Chrome sends no Referer from it under ANY Referrer-Policy, unsafe-url included, so no header change fixes it. Headless tests can miss it: a HeadlessChrome UA got real tiles without a Referer. Fix: a keyless CORS-* provider (OpenFreeMap vector tiles + MapLibre: connect-src https://tiles.openfreemap.org; worker-src blob:) or serve the content from a separate registrable domain without the sandbox.

@mahmoud