fruitymaps icon indicating copy to clipboard operation
fruitymaps copied to clipboard

Apple closed the loophole

Open TimBroddin opened this issue 8 years ago • 15 comments

Apple now checks for origin on requests to their tile-server.

This could be solved by proxy'ing. Will look into this, might be against Apple's conditions.

TimBroddin avatar Apr 25 '16 15:04 TimBroddin

Any update on this @TimBroddin ?

controversial avatar Jun 30 '16 19:06 controversial

Nopes, they didn't announce anything at WWDC and seem to block the option that allowed you to supply your own configuration file. Might look into this soon.

TimBroddin avatar Jun 30 '16 19:06 TimBroddin

Ok, keep me posted, and also let me know if there's any way I could help. My knowledge is limited, but I'd be happy to help in any way I can (I've been meaning to learn Meteor 😛)

controversial avatar Jun 30 '16 19:06 controversial

@controversial What's your use case? If it's about using mapkit bootstrap files, I'm sure a solution can be found replicating the API over some other mapping framework, pretty much like mapstraction did years ago.

IvanSanchez avatar Jul 01 '16 07:07 IvanSanchez

I mostly just like the look of Apple maps. I don't really have a specific use case, I just think this is a cool project

controversial avatar Jul 01 '16 12:07 controversial

@TimBroddin Any update?

craftbyte avatar Aug 20 '16 19:08 craftbyte

@craftbyte sorry for the late reply, I haven't really looked into it, but it seems that Apple has changed their security and doesn't allow third parties to include their script anymore

TimBroddin avatar Aug 30 '16 08:08 TimBroddin

Apple now has this public for any address on their website: https://www.google.com/maps?t=m&ll=42.418399,12.106154&q=Corso+Italia+20,+01100+Viterbo,+Province+of+Viterbo,+Italy

Possible to abuse? An iframe maybe?

controversial avatar Sep 23 '16 15:09 controversial

@controversial That's a... link to google maps? I don't understand what «apple has public for any address» now.

IvanSanchez avatar Sep 23 '16 16:09 IvanSanchez

Shit, I was in a rush and posted the wrong link. Hold up.

controversial avatar Sep 23 '16 16:09 controversial

"Opening Any Apple Maps Place or Address on the Web" https://www.macstories.net/ios/opening-any-apple-maps-place-or-address-on-the-web/

controversial avatar Sep 23 '16 16:09 controversial

@controversial I looked into it yesterday, however, they seem to be doing origin checks so you need an API-key. Let's hope Apple opens this up!

TimBroddin avatar Sep 24 '16 12:09 TimBroddin

Ok. What about embedding their website in an iframe so it appears from the same origin (I think)?

On Sat, Sep 24, 2016 at 8:33 AM Tim Broddin [email protected] wrote:

@controversial https://github.com/controversial I looked into it yesterday, however, they seem to be doing origin checks so you need an API-key. Let's hope Apple opens this up!

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/TimBroddin/fruitymaps/issues/6#issuecomment-249362536, or mute the thread https://github.com/notifications/unsubscribe-auth/AJ5Yr6dWHhhOMn4yPayep1jtbzy1a_6Aks5qtRiKgaJpZM4IPER3 .

controversial avatar Sep 24 '16 12:09 controversial

@controversial Extremely unlikely. A browser cannot inject JS into an iframe (in a reliable way), and techniques like DOM mutation handlers (see https://gitlab.com/IvanSanchez/Leaflet.GridLayer.GoogleMutant) will most probably not work. The iframe will work, but cross-frame communication is subject to a set of restrictions very similar to cross-origin.

IvanSanchez avatar Sep 24 '16 12:09 IvanSanchez

Ah, ok.

On Sat, Sep 24, 2016 at 8:46 AM Iván Sánchez Ortega < [email protected]> wrote:

@controversial https://github.com/controversial Extremely unlikely. A browser cannot inject JS into an iframe (in a reliable way), and techniques like DOM mutation handlers (see https://gitlab.com/IvanSanchez/Leaflet.GridLayer.GoogleMutant) will most probably not work. The iframe will work, but cross-frame communication is subject to a set of restrictions very similar to cross-origin.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/TimBroddin/fruitymaps/issues/6#issuecomment-249363036, or mute the thread https://github.com/notifications/unsubscribe-auth/AJ5Yr_OkAMu1WzyRbg_-yFarUl6pQzjTks5qtRuRgaJpZM4IPER3 .

controversial avatar Sep 24 '16 12:09 controversial