I have been noticing an issue when using my work computer to access some websites, mainly ones with embedded maps like Open Street Maps or Bing (does not seem to affect Google Maps). My colleagues notice the same. Often times, these maps will not load the basemap at all (but they do load the overlaid data from the website that has them embedded), or it will show pink tiles. I noticed that the requests fail with the following message:
'http://a.tile.openstreetmap.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://mncors2.dot.state.mn.us' is therefore not allowed access.
In Chrome, using the extension Allow-Control-Allow-Origin: * fixes the issue, as does using HTTPS if the website has it enabled.
The issue happens in late versions of Chrome, Firefox, and Edge. The issue doesn't happen in Internet Explorer.
Further, this only happens when using the work network. When I try it on my phone over the work WIFI, the issue happens, with WIFI off, the maps load fine.
Is this something that our work firewall could be causing?
If so, what would I need to tell our IT people to fix this?
Can it be fixed without affecting security?
We use a lot of mapping sites here, some that we pay for, and this is a serious productivity issue for some folks.