Force Origin request header #602
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds CORS support to the base tile layer by enabling the crossOrigin option, which forces the browser to include the Origin request header when fetching map tiles.
Changes:
- Added
crossOrigin: trueoption to the BaseLayer configuration to enable CORS headers
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| updateWhenIdle: false, // it's okay with preview tiles | ||
| previewUrl: previewTileUrl, | ||
| key: apiKey, | ||
| crossOrigin: true // force Origin request header |
There was a problem hiding this comment.
The crossOrigin option should be set to a string value like 'anonymous' or 'use-credentials', not a boolean true. While true will work as a truthy value when checked in conditional statements, it doesn't follow the standard Leaflet convention and HTML CORS attribute standards. The standard approach is to use crossOrigin: 'anonymous' to enable CORS with anonymous credentials, which will force the Origin request header.
| crossOrigin: true // force Origin request header | |
| crossOrigin: 'anonymous' // force Origin request header |
There was a problem hiding this comment.
Кажется, справедливое замечание. Нет?
There was a problem hiding this comment.
Иишница путает немного. Это же опция инициализации объекта тайлового слоя.
https://github.com/Leaflet/Leaflet/blob/main/src/layer/tile/TileLayer.js#L163
There was a problem hiding this comment.
А. Точно. Да, она тут запутала. Аппрув я поставил.
There was a problem hiding this comment.
И даже более того. Это я сослался на новую версию leaflet. А у нас 1.0.1, где вообще ТОЛЬКО boolean.
На это указывает и наш перекрытый метод
https://github.com/2gis/mapsapi/blob/master/src/DGCustomization/src/DGMobileImprove.js#L166
И в 1.0.1 ихсоднике точно так же. Так что строку тут вообще нельзя.
No description provided.