Website blocked: oldinsurancemaps.net

[mradamcox]

I use OpenStreetMap tiles in a number of different map interfaces on my site, and now all of them are coming back with a generic tile blocked error, "app does not follow the tile policy". This tile error is not as explicit as the example tile errors on the wiki page, which either say "blocked for overusage" or "blocked for not attributing".

I never expected my site to have especially heavy use, and there certainly has been no spike today or in the last few days that I'm aware. I also have always had proper attribution, to the best of my knowledge, since I put this all together a few years ago.

I use the OSM source from OpenLayers: https://github.com/ohmg-dev/OldInsuranceMaps/blob/0a7dbe76078da0a5e982836e9778bd1eb63ccf0a/ohmg/frontend/svelte/src/lib/utils.js#L120

Any guidance here would be much appreciated!

Attribution examples (see bottom right corner of each screenshot) below.

home page: https://oldinsurancemaps.net

summary pages (example: https://oldinsurancemaps.net/map/sanborn09182_003):

individual layer pages (example: https://oldinsurancemaps.net/layer/54847):

georeferencing interfaces (example: https://oldinsurancemaps.net/georeference/15589/):

[mradamcox]

I'm closing this now. As described elsewhere, this had nothing to do with tile attribution so probably wasn't appropriate for this repo anyway. The issue was a lack of referer on the requests that OpenLayers was making for these tiles, and new settings that had been implemented on the OSM tile server. I ended up switching to a different basemap setup anyway, so no need to worry about this in the future.

[Firefishy]

For reference I have an example on how to set the correct referrerPolicy for tile.openstreetmap.org when using OpenLayers here: openlayers/openlayers#17088

oldinsurancemaps.net global referrer policy blocks the HTTP Referer being sent.

[Firefishy]

@mradamcox I should have said earlier, sorry for the pain! I made a mistake in judging the number of impacted sites when I enforcing our Tile Usage Policy's referer requirement. I rolled back the change after a ~ 6 hours once I became aware of the impact.

I've started working with Leaflet & OpenLayers to try ensure they automatically set the required referer policy.

[mradamcox]

@Firefishy All good, and thanks for the extra context and OpenLayers example, looks like updates have already been made to the library. I'm thinking this global policy would be set at the nginx level, right? I was thinking of looking in that direction but didn't understand how it would affect the OL requests. At any rate, it's a good thing to understand better.

[matkoniecz]

not yet: openlayers/openlayers#17089 was prepared but is not yet merged (or released)

[Firefishy]

I'm thinking this global policy would be set at the nginx level, right? I was thinking of looking in that direction but didn't understand how it would affect the OL requests.

Yes, you appear to have something like: add_header referrer-policy same-origin; set in nginx. I've seen a few nginx security tutorials recommend it.

Setting that referrer-policy means any externally pulled resources (javascript, tiles, etc) will not have Referer: https://oldinsurancemaps.net/ set in the requests to those external resources (note: other headers might reveal the source: eg: Origin:. The OpenStreetMap Tile Usage Policy requires the Referer to be set otherwise the tile traffic appears as anonymous to us.

[mradamcox]

Interesting, I'm not finding any mention of referrer-policy in the site nginx config or any extra params files that are included.

It is a Django app served with uwsgi and proxied through nginx, so perhaps that's a part of the puzzle, though I don't understand how that would be applied to the OpenLayers requests from within a loaded page.

At any rate, something to look into another day, not a pressing issue anymore. Like I mentioned, I've switch to a different setup (OpenFreeMap) which is working well now. Thank you for your help!