Fix: 403 error in map export

core/settings/base.py

@@ -75,6 +75,11 @@
     # ABS_PATH('core', 'base_static'),
 )
 
+# Allow OSM tile servers to receive a Referer header (required by OSM tile policy).
+# Django's SecurityMiddleware defaults to "same-origin", which strips the Referer
+# on cross-origin requests, causing OSM tiles to return 403 "Access blocked".
+SECURE_REFERRER_POLICY = "strict-origin-when-cross-origin"
+
 
 # default middleware classes
 MIDDLEWARE = [

core/settings/contrib.py

@@ -27,7 +27,6 @@
     "DEFAULT_AUTHENTICATION_CLASSES": (
         "rest_framework.authentication.TokenAuthentication",
         "oauth2_provider.contrib.rest_framework.OAuth2Authentication",
-        "rest_framework.authentication.SessionAuthentication",
     ),
     "DEFAULT_PERMISSION_CLASSES": ("rest_framework.permissions.IsAuthenticated",),
     "DEFAULT_RENDERER_CLASSES": (

ui/app/components/aoi/ExportAOI.js

@@ -277,6 +277,7 @@ export class ExportAOI extends Component {
               }),
               OSM.ATTRIBUTION
             ],
+            crossOrigin: null,
             url:
               "https://tile.openstreetmap.org/{z}/{x}/{y}.png"
           })