Forum Discussion

Eduardo41523's avatar
Eduardo41523
Regular Visitor
5 months ago
Solved

Power BI custom visual not sending Referer

Hi, I’m developing a custom visual using React + Leaflet, and I’m trying to load OpenStreetMap tiles: The tiles are being blocked with: “Access blocked - Referrer is required by tile usage policy”...
Need Help
  • Eduardo41523's avatar
    Eduardo41523
    5 months ago

    Thank you for the prompt response! It's unfortunate to hear that there is no way of making custom visuals support referrer requests. We will have to try one of the work-arounds. Thank you again!

SpaceBAWS's avatar
SpaceBAWS
New Member
4 months ago

For other users coming here. Specifically for Custom Power BI Visuals, Referrer Headers, and possibly getting blocked by OpenStreetMap with the 403r referrer is required:

 

Yes, even if you set the reffer-policy for your tile HTTP or HTTPS requests, or if Leaflet.js sets this, the specific Referrer HTTP header never gets sent for Custom Power BI Visuals.

 

This is shown here https://community.openstreetmap.org/t/access-blocked-on-osm-org/141419/43

 

I looked through the Sandbox code for Custom Visuals in Power BI

 

https://app.powerbi.com/13.0.28090.50/cvSandboxPack.cshtml?locale=en-US&pbiglobals=1#e9ae9064-dc5c-44b3-910b-fa0df87535d8

 

It has this injectJsCode function that creates an isolated clone of the window object.

 

// ...

.call(
                    //generate isolated clone of window object
                    (function(w) {
                        var wKeys = Object.getOwnPropertyNames(w);
                        var nextW = w;
                        while ((nextW = Object.getPrototypeOf(nextW))) {
                            wKeys = wKeys.concat(Object.getOwnPropertyNames(nextW));
                        }
                        var newWindow = Object.create(w);
                        //rebuild some of the window properties so they work correctly
                        for (var i = 0; i < wKeys.length; i++) {
// ...

 

I don't know exactly how, but this seems to make the Referrer header not send, even if you set the Referrer Policy to a value that would send a Referrer header. I feel like the JavaScript loses what host/domain/origin it's running when the Window object is cloned (created) like this.