<div style="display: flex; flex-wrap: wrap; white-space: pre-wrap; align-items: center; "><img height="20" width="20" style="border-radius:50%; margin-right: 4px;" decoding="async" src="https://avatars.githubusercontent.com/u/36066?s=20&v=4" /><strong>pablobm</strong> left a comment <a href="https://github.com/openstreetmap/openstreetmap-website/pull/6595#issuecomment-3627681226">(openstreetmap/openstreetmap-website#6595)</a></div>
<p dir="auto">I'm seeing the same as <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/tomhughes/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/tomhughes">@tomhughes</a>:</p>
<a href="https://github.com/user-attachments/assets/7c424753-b684-4982-8d5c-8008bf08cd85">cors-shortbread-colorful-style.png (view on web)</a>
<p dir="auto">Confusingly, sometimes the Firefox network inspector shows the error, and sometimes it doesn't, loads the data from cache, and pretends that all is ok, but the map still doesn't load (it's completely blank). All I see in the console is two CSP warnings that I think are unrelated.</p>
<p dir="auto">My recollection of how CORS works is sketchy, but I can't see any <code class="notranslate">Access-Control-*</code> headers?</p>
<pre class="notranslate"><code class="notranslate">$ curl --silent -i https://vector.openstreetmap.org/styles/shortbread/colorful.json | head -n 50
HTTP/2 200
server: nginx
content-type: application/json
last-modified: Sun, 07 Dec 2025 22:15:43 GMT
etag: "6935fc8f-4a18d"
cache-control: public,max-age=300,stale-while-revalidate=3600,stale-if-error=86400
x-rendered-by: cmok.openstreetmap.org
accept-ranges: bytes
age: 196
date: Mon, 08 Dec 2025 15:55:52 GMT
via: 1.1 varnish
x-served-by: cache-lcy-eglc8600024-LCY
x-cache: HIT
x-cache-hits: 0
x-timer: S1765209353.940283,VS0,VE2
vary: Origin, Accept-Encoding
strict-transport-security: max-age=31557600
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 303501

{
  "version": 8,
  "name": "versatiles-colorful",
  ...
</code></pre>

<p style="font-size:small;-webkit-text-size-adjust:none;color:#666;">—<br />Reply to this email directly, <a href="https://github.com/openstreetmap/openstreetmap-website/pull/6595#issuecomment-3627681226">view it on GitHub</a>, or <a href="https://github.com/notifications/unsubscribe-auth/AAK2OLPUV2QOLAG2ENPOJTD4AWNXHAVCNFSM6AAAAACOKGI3HCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTMMRXGY4DCMRSGY">unsubscribe</a>.<br />You are receiving this because you are subscribed to this thread.<img src="https://github.com/notifications/beacon/AAK2OLML4VNGYEUJZX6LOF34AWNXHA5CNFSM6AAAAACOKGI3HCWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTWYHIC4U.gif" height="1" width="1" alt="" /><span style="color: transparent; font-size: 0; display: none; visibility: hidden; overflow: hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0; mso-hide: all">Message ID: <span><openstreetmap/openstreetmap-website/pull/6595/c3627681226</span><span>@</span><span>github</span><span>.</span><span>com></span></span></p>

<script type="application/ld+json">[
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"potentialAction": {
"@type": "ViewAction",
"target": "https://github.com/openstreetmap/openstreetmap-website/pull/6595#issuecomment-3627681226",
"url": "https://github.com/openstreetmap/openstreetmap-website/pull/6595#issuecomment-3627681226",
"name": "View Pull Request"
},
"description": "View this Pull Request on GitHub",
"publisher": {
"@type": "Organization",
"name": "GitHub",
"url": "https://github.com"
}
}
]</script>