Mapbox-gl-js: Ghostery request modification

[peeves6]

Hi, the latest version of Ghostery appears to be modifying the request to mapbox and replacing the access token with ghostery.

I tried adding the content security policy as per the docs but this has no impact.

While I can disable ghostery on my browser, I can't ask the users of my site to do the same. Is there any way around this?

Replacing the access token results in a 401 and the map doesn't get displayed at all.

Thanks!

[arindam1993]

Hi @peeves6, I'm unable to replicate this with Chrome, the gl-js example pages and the latest version of Ghostery.

Could you provide more details, including the Ghostery settings you might be using

[peeves6]

Hi @arindam1993 ,

Please see https://indiamaoisttracker.com

This is an issue only with Ghostery on Firefox. On Chrome, with Ghostery, I have no issues. I'm using the default settings - I have attached the exported settings blob - but they are basically:
block_by_default":false,"
enable_ad_block":true,"
enable_anti_tracking":true,"
enable_smart_block":true,"

When I access the site, the Mapbox request is changed to:
https://api.mapbox.com/styles/v1/{user}/{styles}?access_token=ghostery

If I mark the site as trusted in ghostery, then all works fine.

I don't know how to get it to stop modifying the URL. I thought the CSP would address it but that doesn't seem to be the case.

Thanks

[asheemmamoowala]

Closing because there is nothing actionable in mapbox-gl-js for this issue. The access token is not tracking the user's behavior in any way, it is used to allow access to mapbox-hosted resources.
It would need to be resolved with Ghostery - either by white listing mapbox domain or changing it's configuration some other way.

[akmur]

I am also having this problem in Firefox. While I understand it's not a mapbox issue per se, I think it would be cool if Mapbox could contact Ghostery and ask them to whitelist their service.

[liefra]

I see the same issue with the Chrome Ghostery add-on. Already trusted the site, but this doesn't help. With Ghostery add-on disabled and in another browser all works well.

[DJAxel]

Same problem in Chrome, but for me trusting the website does work. It's annoying though that users have to do this manually and first have to find about what's actually causing this problem.

[lukeb]

I'm having the same issue with ghostery replacing the mapbox access_token in the URL requests for static maps. I'm using Chrome and the ghostery Chrome extension.

[jeroenbraspenning]

I've got this issue as well. The access_token gets replaced with Ghostery.
https://api.mapbox.com/styles/v1/mapbox/light-v10?access_token=ghostery

The weird thing is that it doesn't happen on jsfiddle mapbox examples for instance. Even though Ghostery is running there as well.

[christophertino]

We've added the Mapbox access_token to our anti-tracking whitelist. If you're still running into problems, please open an issue and let us know. ghostery/ghostery-extension

[asheemmamoowala]

Thank you for fixing this @christophertino!