5

I created an answer for HERE maps autocomplete API on Stack Overflow and I'm having an issue with the HTTP_REFERER header not being sent when using Chrome browser (works fine w/ Edge and IE).

This causes a problem since the ajax call to the API returns 401 (unauthorized) in the code snippet. The API relies on the HTTP_REFERER header as a means to prevent misuse.

Looking at the problem I noticed that the generated iframe element doesn't have a src attribute and that it appears that this is a known issue in Chromium.

Is there anyway to overcome this? Maybe add a dummy src attribute set as https://stacksnippets.net/?

EDIT: The dummy src attribute didn't work, but setting srcdoc attribute did allow HTTP_REFERER header to be included in request.

Documentation states the following for srcdoc attribute.

The content of the page that the embedded context is to contain. This attribute is expected to generally be used together with the sandbox attribute. If a browser supports the srcdoc attribute, it will override the content specified in the src attribute (if present). If a browser does NOT support the srcdoc attribute, it will show the file specified in the src attribute instead (if present).

4
  • In the mean time, would it be possible to add yourself an iframe inside your snippet with the desired srcdoc?
    – Cœur
    Commented Dec 1, 2018 at 13:50
  • 2
    According to the specification, the referer header is an optional header, so you cannot depend on it being always send
    – Ferrybig
    Commented Dec 2, 2018 at 11:51
  • While StackSnippets could be improved in that regard, I would still consider this a bug in the HERE API.
    – Bergi
    Commented Dec 2, 2018 at 22:36
  • @Bergi It's not a bug in the HERE API, restricting access by referer is an optional setting, similar to Google API restrictions. HERE maps has kindly added stacksnippets.net as an allowed domain so we have to work with what we've been provided or not access the API at all.
    – Mark G
    Commented Dec 3, 2018 at 0:17

0

You must log in to answer this question.

Browse other questions tagged .