I created an answer for HERE maps autocomplete API on Stack Overflow and I'm having an issue with the HTTP_REFERER
header not being sent when using Chrome browser (works fine w/ Edge and IE).
This causes a problem since the ajax call to the API returns 401 (unauthorized) in the code snippet. The API relies on the HTTP_REFERER
header as a means to prevent misuse.
Looking at the problem I noticed that the generated iframe
element doesn't have a src
attribute and that it appears that this is a known issue in Chromium.
Is there anyway to overcome this? Maybe add a dummy src
attribute set as https://stacksnippets.net/?
EDIT: The dummy src
attribute didn't work, but setting srcdoc
attribute did allow HTTP_REFERER
header to be included in request.
Documentation states the following for srcdoc
attribute.
The content of the page that the embedded context is to contain. This attribute is expected to generally be used together with the sandbox attribute. If a browser supports the srcdoc attribute, it will override the content specified in the src attribute (if present). If a browser does NOT support the srcdoc attribute, it will show the file specified in the src attribute instead (if present).
stacksnippets.net
as an allowed domain so we have to work with what we've been provided or not access the API at all.