Currently trying to return popups from WMS layer can fail if the WMS comes from certain sources.
From Chrome console:
Refused to frame 'https://data.gns.cri.nz/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self' *.gns.cri.nz geotrips.org.nz *.geotrips.org.nz".
From Chrome Issues:
Content Security Policy of your site blocks some resources because their origin is not included in the content security policy header The Content Security Policy (CSP) improves the security of your site by defining a list of trusted sources and instructs the browser to only execute or render resources from this list. Some resources on your site can't be accessed because their origin is not listed in the CSP. To solve this, carefully check that all of the blocked resources listed below are trustworthy; if they are, include their sources in the content security policy of your site. You can set a policy as a HTTP header (recommended), or via an HTML <meta> tag. :warning: Never add a source you don't trust to your site's Content Security Policy. If you don't trust the source, consider hosting resources on your own site instead. 1 directive Resource Status Directive Source code https://data.gns.cri.nz/ blocked frame-ancestors Learn more: Content Security Policy - Source Allowlists
If we could add the domains of those WMS layers to a list of domains that are included in CSP headers then the popups would load. This could be done:
My preference is in the map - so you add a WMS service, and then if the popup isn't loading you can define the server in the map settings that should be allowed and then it is included in the headers when the map loads.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.