Apple closed the loophole

[TimBroddin]

Apple now checks for origin on requests to their tile-server.

This could be solved by proxy'ing. Will look into this, might be against Apple's conditions.

[controversial]

Any update on this @TimBroddin ?

[TimBroddin]

Nopes, they didn't announce anything at WWDC and seem to block the option that allowed you to supply your own configuration file. Might look into this soon.

[controversial]

Ok, keep me posted, and also let me know if there's any way I could help. My knowledge is limited, but I'd be happy to help in any way I can (I've been meaning to learn Meteor 😛)

[IvanSanchez]

@controversial What's your use case? If it's about using mapkit bootstrap files, I'm sure a solution can be found replicating the API over some other mapping framework, pretty much like mapstraction did years ago.

[controversial]

I mostly just like the look of Apple maps. I don't really have a specific use case, I just think this is a cool project

[craftbyte]

@TimBroddin Any update?

[TimBroddin]

@craftbyte sorry for the late reply, I haven't really looked into it, but it seems that Apple has changed their security and doesn't allow third parties to include their script anymore

[controversial]

Apple now has this public for any address on their website: https://www.google.com/maps?t=m&ll=42.418399,12.106154&q=Corso+Italia+20,+01100+Viterbo,+Province+of+Viterbo,+Italy

Possible to abuse? An iframe maybe?

[IvanSanchez]

@controversial That's a... link to google maps? I don't understand what «apple has public for any address» now.

[controversial]

Shit, I was in a rush and posted the wrong link. Hold up.

[controversial]

"Opening Any Apple Maps Place or Address on the Web" https://www.macstories.net/ios/opening-any-apple-maps-place-or-address-on-the-web/

[TimBroddin]

@controversial I looked into it yesterday, however, they seem to be doing origin checks so you need an API-key. Let's hope Apple opens this up!

[controversial]

Ok. What about embedding their website in an iframe so it appears from the
same origin (I think)?

On Sat, Sep 24, 2016 at 8:33 AM Tim Broddin notifications@github.com
wrote:

@controversial https://github.com/controversial I looked into it
yesterday, however, they seem to be doing origin checks so you need an
API-key. Let's hope Apple opens this up!

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#6 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AJ5Yr6dWHhhOMn4yPayep1jtbzy1a_6Aks5qtRiKgaJpZM4IPER3
.

[IvanSanchez]

@controversial Extremely unlikely. A browser cannot inject JS into an iframe (in a reliable way), and techniques like DOM mutation handlers (see https://gitlab.com/IvanSanchez/Leaflet.GridLayer.GoogleMutant) will most probably not work. The iframe will work, but cross-frame communication is subject to a set of restrictions very similar to cross-origin.

[controversial]

Ah, ok.

On Sat, Sep 24, 2016 at 8:46 AM Iván Sánchez Ortega <
notifications@github.com> wrote:

@controversial https://github.com/controversial Extremely unlikely. A
browser cannot inject JS into an iframe (in a reliable way), and techniques
like DOM mutation handlers (see
https://gitlab.com/IvanSanchez/Leaflet.GridLayer.GoogleMutant) will most
probably not work. The iframe will work, but cross-frame communication is
subject to a set of restrictions very similar to cross-origin.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#6 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AJ5Yr_OkAMu1WzyRbg_-yFarUl6pQzjTks5qtRuRgaJpZM4IPER3
.