---
title: "Important: The partner map allows its tiles under a security policy"
manual: "Academic Partners"
version: "main"
permalink: "https://docs.typo3.org/permalink/fgtclb/academic-partners:important-ace-933-academic-partners@main"
source: "Changelog/2.4/Important-PartnerMapTilesUnderAContentSecurityPolicy.rst"
rendered: "2026-10-26T19:20:19+00:00"
---

# Important: The partner map allows its tiles under a security policy {#important-ace-933-academic-partners}

## Description {#description}

The **Partners Map** content element loads the tiles of its map as
images from a tile server, OpenStreetMap by default. The frontend Content
Security Policy of TYPO3 allows images from the site itself, `data:` URLs
and the preview images of YouTube and Vimeo only. Once a site enforced that
policy, with the feature `security.frontend.enforceContentSecurityPolicy`
for example, the browser blocked every tile, and the markers stayed on an empty
map.

The element now extends the directive `img-src` of the policy of the page it is
rendered on by the host of the tile URL the map uses. A host label with a
placeholder becomes a wildcard, so the default
`https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png` adds
`https://*.tile.openstreetmap.org`. A page without the element gets no source.
The source is registered while TYPO3 renders the page and is kept with the page
in the page cache, so a cached page sends it as well.

## Impact {#impact}

-   On a site that enforces the frontend policy of TYPO3, the map shows its
    tiles again.
-   A site that added the host of the tile server to `img-src` in its
    `csp.yaml` can keep that rule or remove it. The source is not added
    twice.
-   On TYPO3 13 and newer, a site that renders the element without the data
    processors of `lib.contentElement` adds the host of the tile
    server in its `csp.yaml`:

    **config/sites/\<site>/csp.yaml**

    ```yaml
    mutations:
      - mode: extend
        directive: 'img-src'
        sources:
          - 'https://*.tile.openstreetmap.org'
    ```
-   A policy that the web server or a proxy sends is not covered. The browser
    enforces it next to the one of TYPO3, or in its place, so it needs the
    same source itself.
-   Behaviour is identical on every supported TYPO3 version.