Incorrect User-Agent sent by Mapfish to OSM tileservers

[pnorman]

The OSMF Operations Working Group just got an email from a user of Mapfish that their tile access was blocked when trying to build a PDF.

I was able to identify their requests in the logs and Mapfish was copying the user-agent of a browser. Mapfish is a Java application, not a browser, and should not be sending the User-agent and referer for the browser that triggers the PDF build.

Mapfish must send a valid HTTP User-Agent identifying itself. I recommend that it also include its version so that if one version is bugged and needs to be blocked, it doesn't impact all versions. An example of a user-agent that would do this is org.mapfish.print/3.28.1

If there is a way for mapfish to identify its installation, it could add a space followed by this information at the end. This would mean that one Mapfish installation that was overusing our servers would not require us to block all Mapfish installations.

You should also not be sending a referer, because you are not a browser requesting from a referering webpage.

I've temporarily lifted the block of fake browsers to give Mapfish time to fix this but need to reapply it, since there are a lot of fake browsers that try to scrape the OSM tiles.

Related to this, I recommend you use the URL "https://tile.openstreetmap.org/" for tiles. Using HTTP or using {a,b,c}.tile.openstreetmap.org will be slightly slower.

[pnorman]

Are there any plans to look into this?

[jwkaltz]

Are there any plans to look into this?

@pnorman Yes, sorry for the late reply. I will schedule a deeper look for next week.

[jwkaltz]

@pnorman I discussed your proposal with some of the MapFish Print devs, and it makes sense to us to add a user-agent such as for example "org.mapfish.print/3.28.1", this should be implemented soon, and included in the next release.
We were wondering who is currently impacted, you mentioned an email from a user?

[pnorman]

We were wondering who is currently impacted, you mentioned an email from a user?

All mapfish users would have been impacted by the block. I'd have to look into privacy before revealing the name of the user who first reported it.