Request unblock

[jamie-carbon-critical]

Hello,

The OSM maps in my prototype web app https://multispecies.nz have been blocked. I apologize that I was not aware of the missing attributions.

This has now been fixed by adding attributions to all maps according to the guidelines at:
https://osmfoundation.org/wiki/Licence/Attribution_Guidelines:

attribution="OpenStreetMap"

Changes have been pushed. Can you please review + release the block?

Many thanks for providing the OSM platform.

All the best,
Jamie

[matkoniecz]

Are you sending referrer as required by https://operations.osmfoundation.org/policies/tiles/ ?

See #157 (comment) - it seems to be among recent changes.

---

it was not blocked for missing attribution

I amended https://wiki.openstreetmap.org/wiki/Blocked_tiles to clarify that

If block mentions more general "not following the tile usage policy" then review tile usage policy instead as it was not blocked for missing attribution.

and reduce confusion

---

See also #162 (comment)

I have now temporarily removed the referer check for tile.openstreetmap.org. I will bring it back a bit more gently later. Please fix your site in the interim.

if you site works now: that is temporary. Please, fix it and follow https://operations.osmfoundation.org/policies/tiles/ including currently not enforced parts. They may become enforced at any time.

[Firefishy]

We temporarily enforced our HTTP referer requirement of our usage policy: https://operations.osmfoundation.org/policies/tiles/
We have rolled back the change while we re-evaluate how to enforce it.

It is likely your web app was not sending an HTTP referer request header. This is normally due to the setting Referrer-Policy=no-referrer or Referrer-Policy=same-origin for the website.

If you are using leafletjs you can override this by setting something like this (note the referrerPolicy portion), your code will be different:

var osm == L.tileLayer('https://tile.openstreetmap.org/{z}/{x}/{y}.png', { attribution: '© <a href="https://www.openstreetmap.org/copyright">OpenStreetMap</a> contributors', referrerPolicy: 'origin-when-cross-origin' });

[jamie-carbon-critical]

Thanks @Firefishy, your leafletjs example is very helpful. It is not at all clear otherwise from the guidelines how the referrer requirement should be implemented.

E.g. I asked ChatGPT to read the guidelines and provide practical recommendations on how to implement them, and it came back with "browsers send a valid Referer header, which satisfies the requirement".

And the sentence in your own guidelines "Note: modern web browsers in standard configuration pass all the above technical requirements." suggests that devs do not need to overly concern themselves about compliance.

No doubt a more experienced web developer would have known how to properly interpret your requirements, but presumably you are not intending to make your service difficult to use for those who are starting out with mapping functionality?

Perhaps including some explicit examples for the most common use cases on the guidelines page would be helpful? (The single line of code for you provide above for the leafletjs example is more helpful to me than the entire guidelines page!)

Also please be aware that blocking access is extremely disruptive and damaging. I am glad you guys are considering 'gentler' methods of enforcement. A subtle message/watermark or anything that interferes with the aesthetics of the page/map would be sufficient to prompt most developers to take action, without making it look like some horrendous virus has infected their website!!

PS: Thanks for all you do! The above is meant to be constructive feedback, not a gripe :)

[matkoniecz]

From what I see Referer https://multispecies.nz/ is currently being send

[jamie-carbon-critical]

Thanks @matkoniecz, I think I have now updated all my web apps to be compliant, so I'm glad you can see that on your side :)

[matkoniecz]

To be clear - I have no access to server logs and just looked at linked site in developer tools in Firefox (and if you are unfamiliar with it - browser console is extremely useful!)

[Firefishy]

@jamie-carbon-critical We are working on a new revision of Tile Usage Policy which addresses some of the issues you have raised.

Current preview: https://github.com/openstreetmap/owg-website/blob/d8fcd22ccd0a217390ff8e81332077b773d43896/policies/tiles.md

[jamie-carbon-critical]

Thanks @Firefishy. I see the policy has gone from ~800 words to ~1300 words, but still lacks practical info/examples. I would suggest a heading along the lines of:

Usage examples

The following examples/notes show how to achieve compliance for common usage scenarios.
leafletjs
var osm == L.tileLayer('https://tile.openstreetmap.org/{z}/{x}/{y}.png', { attribution: '© <a href="https://www.openstreetmap.org/copyright">OpenStreetMap</a> contributors', referrerPolicy: 'origin-when-cross-origin' });

(Other common use cases...)

...

[matkoniecz]

I would not try to maintain such example. Maybe linking pages maintained by leaflet et all would be acceptable and would not sign up for continued maintenance?

[Firefishy]

I already have a PR open with Leaflet to ensure no explicit developer action is required.

Maintaining a list of examples if beyond what our 3 person Ops team could maintain. It would be better to fix upstream implementations or their documentation.