Make it clear in the documentation that the OpenStreetMap tile usage policy requires sending the referrer header

[maxfenv]

This PR changes the default tile layer configured by django-leaflet to include a sensible referrerPolicy, a requirement (which is now actually enforced) of the OSM tile usage policy.

It also updates the documentation to urge users to set this when configuring their own tiles.

For context, you may find the PR in leaflet helpful/interesting: Leaflet/Leaflet#9883.

[sposs]

This is a real issue, please consider it with some priority.

[citizenfish]

This really needs to be merged. Anyone looking for a temp fix add this to LEAFLET_CONFIG in settings.py :-

    'TILES': [('OSM', 'http://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png', {
        'attribution': '© <a href="https://www.openstreetmap.org/copyright">OpenStreetMap</a> contributors',
        'referrerPolicy': 'strict-origin',
    })]

[claudep]

@Gagaro Anything preventing merging this from your point of view? I was affected, too.

[webkrab]

Checked this code change, i dont see any issue, for holding it back.

it does the required stuff mentiond by OSM:
[403r] _If the tile mentions "Referer is required" then you were automatically blocked because your application/website is not sending HTTP Referer headers, but doing so is required by the tile usage policy. This block will resolve itself once you make the necessary changes to your application, without further intervention necessary.

For websites/web applications, this can be fixed by setting your Referrer-Policy header to any of no-referrer-when-downgrade, origin, origin-when-cross-origin, strict-origin, or strict-origin-when-cross-origin.

For more information, see the Referer article._

https://wiki.openstreetmap.org/wiki/Blocked_tiles

[ElementW]

@webkrab Looks good to me, especially since I wrote the section you quoted 😛

Though @maxfenv I'd suggest you implement forced attribution just like Leaflet did in Leaflet/Leaflet#9897, because there has been a nonzero amount of sites intentionally setting the attribution field to empty.
The goal isn't to strictly prevent hiding attribution (one can still use CSS and whatnot), but rather to make it clear that the easy way out isn't supported and maybe make the developers think twice.

[maxfenv]

@ElementW it seems unnecessary to implement forcing of the attribution also here, given that it's forced in leaflet directly anyway. django-leaflet is just a wrapper anyway.

[maxfenv]

In fact, given that Leaflet now directly sets referrerPolicy sensibly by default, is there still any point in this PR? Presumably yes, since there won't be a 1.x release (of leaflet) with that change.

[Gagaro]

Sorry for the delay, I've been busy these last few months!

I'll merge and make a new release ASAP.