HTTP 403 on OSM tiles due to missing header Referrer-Policy

Well no, definitely DOES NOT look a Drupal Leaflet module BUG,
but something specifically related to your pages web server setup and requests to OpenstreetMap Tiles.
Probably your specific setup make your browser not sending HTTP Referer.
You should better set your settings and make sure you are complying with OpenstreetMap Tile Usage Policy: https://operations.osmfoundation.org/policies/tiles/

On the Drupal Leaflet module side all looks working fine.
I can’t reproduce the issue you report in some Drupal Leaflet module implementations that I manage, and that are still working fine on the OpenstreetMap tiles, as you can check by yourself:

Drupal Geofield - Leaflet map Demo site:
https://www.geodemocracy.com/drupal_geofield_stack_demo/web/geojson-map-...
Drupal Core: 11.3.4 - PHP: 8.3.30 - Drupal Leaflet: 10.4.4
(screenshot attached showing Referrer set in the HPP Request … )

Taranto-Viva website: https://www.taranto-viva.com
Drupal Core: 11.3.5 - PHP: 8.3.30 - Drupal Leaflet: 10.4.4
Just check and choose the Openstreetmap Layer from the Switcher on the top-right corner
(screenshot attached showing Referrer set in the HPP Request … )

The Way of GODS prototype: https://www.geodemocracy.com/via-degli-dei-2024/web/
Drupal Core: 11.3.5 - PHP: 8.3.30 - Drupal Leaflet: 10.2.43
Just check and choose the Openstreetmap Layer from the Switcher on the top-right corner
(screenshot attached showing Referrer set in the HPP Request … )

Just make sure you are correctly setting and requiring Openstreet Map Tiles layer so as described in the Drupal Leaflet module documentation:
https://git.drupalcode.org/project/leaflet#defining-a-custom-map--hook_l...

and make sure you are not making strange overrides/alters in your server setup Http Requests.

fwiw, I had a site with this issue. It turns out I had seckit module enabled with referrer policy set to same-origin. Per advice at https://wiki.openstreetmap.org/wiki/Blocked_tiles#Referer_is_required setting the seckit referrer policy to origin-when-cross-origin meant referer header is sent and OSM is serving tiles ok.

There are security benefits of setting the referrer to something like same-origin, so would not recommend changing that. Leaflet has the option to set a referrer for retrieving the tiles. That way you only change the referrer for getting some tiles.

You can do something like this:

(function () {
  'use strict';

  if (typeof L !== 'undefined' && L.TileLayer) {
    L.TileLayer.prototype.options.referrerPolicy = 'origin';
  }
})();

Reopening this issue with a patch, as suggested in #6, but only for OpenStreetMap (OSM).

This patch adds a hook in js/leaflet.drupal.js that sets referrerPolicy: 'strict-origin-when-cross-origin' only for OSM tile servers (tile.openstreetmap.org). If a layer already has its own referrerPolicy, it remains unchanged.

This allows OSM to receive only the site's origin as the Referer, without sending the full URL. The approach is similar to the upstream Leaflet PR: https://github.com/Leaflet/Leaflet/pull/9883.

Tested on version 10.4.13 (Leaflet JS 1.9.4) with Referrer-Policy: same-origin.

• Without the patch: No Referer is sent, and OSM tiles show "Access blocked". The requests return HTTP 200, so the error is not obvious in the network status.
• With the patch: The origin is sent as the Referer, and the tiles load correctly.

I think it is good to have a global hardened referrer policy, and add only exceptions to it.
To not need to soften it globally, I like the patch on #comment-16808805 from cezara.
Would be great to get this into the module!

thank you!