I created an answeranswer for HERE maps autocomplete API on Stack Overflow and I'm having an issue with the HTTP_REFERER
header not being sent when using Chrome browser (works fine w/ Edge and IE).
This causes ana problem since the ajax call to the API returns 401 (unauthorized) in the code snippet. The API relies on the HTTP_REFERER
header as a means to prevent misuse.
Looking at the problem I noticed that the generated iframe
element doesn't have a src
attribute and that it appears that this is a known issue in Chromium.
Is there anyway to overcome this? Maybe add a dummy src
attribute set as https://stacksnippets.net/?
EDIT: The dummy src
attribute didn't work, but setting srcdoc
attribute did allow HTTP_REFERER
header to be included in request.
Documentation states the following for srcdoc
attribute.
The content of the page that the embedded context is to contain. This attribute is expected to generally be used together with the sandbox attribute. If a browser supports the srcdoc attribute, it will override the content specified in the src attribute (if present). If a browser does NOT support the srcdoc attribute, it will show the file specified in the src attribute instead (if present). Note that if the content of the attribute contains a script tag then a closing script tag is required for the script to run, even if nothing else comes after the script.