fix(web): weather map tiles load under no-referrer - #973
Conversation
The box sends Referrer-Policy: no-referrer on every response. OSM's volunteer tile servers now require a Referer from web pages, so the location picker rendered their "Access blocked" tiles. Leaflet already supports a per-image referrerPolicy; set it on this layer only so the rest of the UI stays no-referrer.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 768e8c632d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| assert.match(weather, /tile\.openstreetmap\.org/); | ||
| assert.match(weather, /referrerPolicy:\s*"strict-origin-when-cross-origin"/); | ||
| const leaflet = readFileSync(join(vendor, 'leaflet.js'), 'utf8'); | ||
| assert.match(leaflet, /typeof this\.options\.referrerPolicy/); |
There was a problem hiding this comment.
For FTW pages served with the global Referrer-Policy: no-referrer header, these regex assertions only prove that the option and Leaflet assignment exist; they do not verify that a browser actually sends the Referer or that OSM renders real tiles. The test still passes if the original blocked-tile behavior remains, so this UI fix needs the required human browser inspection of Settings → Weather rather than being treated as behaviorally verified.
AGENTS.md reference: AGENTS.md:L90-L91
Useful? React with 👍 / 👎.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
2 participants
Accepted text proposal
Issue or Discussion: user report of the Weather settings map showing OSM “Access blocked. Referer is required” tiles.
Maintainer comment that accepted this scope: in-tree bugfix from a production screenshot; not an external contribution.
What changed
Leaflet on Settings → Weather now sets
referrerPolicy: "strict-origin-when-cross-origin"on the OSM tile layer. Tile<img>requests send the origin (http://192.168.x.x:8080) and not the path. The globalReferrer-Policy: no-referrerheader is unchanged. Cache-buster onweather.jsbumped so existing boxes pick up the script.Why
The box sends
Referrer-Policy: no-referreron every HTTP response (intentional: do not leak the local URL to third parties). OSM’s volunteer tile servers now enforce their long-standing rule that web pages must send a Referer. Without one they still return HTTP 200, but the body is their “Access blocked” PNG (x-blockedheader). That is the screenshot.Leaflet 1.9.4 already applies
options.referrerPolicyto each tile image, which overrides the document policy for those requests only. OSM and Leaflet both recommendstrict-origin-when-cross-origin.Checked against
tile.openstreetmap.orgfrom this environment (browser UA):x-blocked: Access deniedReferer: http://192.168.1.50:8080/→ 200, real map tileBoundaries and safety
feat(web): draw your PV arrays on the map) also editsweb/settings/tabs/weather.js. This change is the tileLayer option plus a comment; that branch can rebase.Verification
node --test web/leaflet-vendor.test.mjs— 3 pass, including a source assertion that the weather map sets the LeafletreferrerPolicyand still usestile.openstreetmap.org.Checklist