3

I have been noticing an issue when using my work computer to access some websites, mainly ones with embedded maps like Open Street Maps or Bing (does not seem to affect Google Maps). My colleagues notice the same. Often times, these maps will not load the basemap at all (but they do load the overlaid data from the website that has them embedded), or it will show pink tiles. I noticed that the requests fail with the following message:

'http://a.tile.openstreetmap.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://mncors2.dot.state.mn.us' is therefore not allowed access.

In Chrome, using the extension Allow-Control-Allow-Origin: * fixes the issue, as does using HTTPS if the website has it enabled.

The issue happens in late versions of Chrome, Firefox, and Edge. The issue doesn't happen in Internet Explorer.

Further, this only happens when using the work network. When I try it on my phone over the work WIFI, the issue happens, with WIFI off, the maps load fine.

  • Is this something that our work firewall could be causing?

  • If so, what would I need to tell our IT people to fix this?

  • Can it be fixed without affecting security?

We use a lot of mapping sites here, some that we pay for, and this is a serious productivity issue for some folks.

Improve this question

1 Answer 1

Reset to default
4

Is this something that our work firewall could be causing?

Yes, it’s not letting all HTTP headers through. It probably has a whitelist of allowed headers and its configuration is very outdated. CORS is relatively new.

If so, what would I need to tell our IT people to fix this? Can it be fixed without affecting security?

They need to update their proxy configuration (or more precisely: the list of allowed HTTP headers). Or just remove those ridiculous limitations completely. This doesn’t affect security anyway.

Improve this answer
2
  • Thanks Daniel B! Our IT people whitelisted the header and it resolved the issue. If possible, can you elaborate why this is not a security issue, or point me to a reference? All I can find is server-side stuff, no mentions of this being filtered client-side.
    – PhilippNagel
    Nov 1, 2016 at 20:42
  • It's simply impossible to trigger any malicious behavior via HTTP headers. The worst it could do is either DoS a crappy proxy/firewall by using large values (the cookie header is a favorite in that regard) or trigger exploits. But you can't really prevent the latter anyway, the reduction in attack surface is so small it isn't worth the trouble. Imagine how much money the company lost on this issue alone.
    – Daniel B
    Nov 1, 2016 at 21:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.