graham/prop
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin referrer policy so OSM tile requests always send a Referer

Browse source 
OSM's tile usage policy requires a Referer header identifying the site.
strict-origin-when-cross-origin is the current browser default and sends
the origin on HTTPS→HTTPS cross-origin requests; pinning it explicitly
prevents silently losing the header if a browser default ever changes.
This commit is contained in:
Graham McIntire 2026-04-09 09:30:09 -05:00
parent ceb90078c1
commit abe0aa9ec6
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
lib/microwaveprop_web/components/layouts/root.html.heex
View file

@ -4,6 +4,14 @@
<meta charset="utf-8" /> <meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" /> <meta name="viewport" content="width=device-width, initial-scale=1" />
<meta name="csrf-token" content={get_csrf_token()} /> <meta name="csrf-token" content={get_csrf_token()} />
<%!--
OpenStreetMap's tile usage policy requires a Referer header identifying
the site using their tiles. strict-origin-when-cross-origin sends just
the origin (e.g. https://prop.w5isp.com) on cross-origin HTTPS requests,
which is the minimum OSM asks for. Explicit so we don't silently lose
the Referer if a future browser default changes.
--%>
<meta name="referrer" content="strict-origin-when-cross-origin" />
<.live_title default="North Texas Microwave Society" suffix=" · NTMS"> <.live_title default="North Texas Microwave Society" suffix=" · NTMS">
{assigns[:page_title]} {assigns[:page_title]}
</.live_title> </.live_title>