Skip to content

fix(site): replace external OpenStreetMap tiles with self-contained CSP-safe spatial canvas - #200

Merged
brucearctor merged 1 commit into
apache:masterfrom
brucearctor:fix/csp-spatial-map
Oct 12, 2026
Merged

brucearctor merged 1 commit into
apache:masterfrom
brucearctor:fix/csp-spatial-map

Conversation

@brucearctor

Copy link
Copy Markdown
Contributor

Summary

  • Root Cause: Apache Software Foundation (*.apache.org) enforces a strict Content Security Policy (CSP) and privacy policy (img-src 'self' data:) that blocks third-party tile servers (*.tile.openstreetmap.org).
  • Fix (site/_includes/useralejsDemo.html, site/_sass/_userale.scss):
    • Replaced L.tileLayer('https://{s}.tile.openstreetmap.org/...') with a 100% self-contained, CSP-compliant Leaflet SVG spatial coordinate grid, interactive Flagon architecture nodes (UserALE.js Browser Client, OpenTelemetry Collector (OTLP), Apache Flagon Distill, OpenSearch / Apache Iceberg), and live click-marker pins.
  • Verification (products/userale/test/spec/04-package-site-demo.spec.ts):
    • Added an assertion verifying #map-example interaction capture and zero external network requests (expect(externalRequests).toEqual([])) in Chromium and Firefox.

@brucearctor
brucearctor merged commit e7b73d8 into apache:master Oct 12, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant