restrictCredentialsToTrustedOrigins @beta

restrictCredentialsToTrustedOrigins: boolean = false

Opt-in enforcement of origin restrictions on map-layer credentials. When enabled, map layer providers:

• attach the basic-auth credentials stored in the layer settings only to requests targeting the origin of the layer's settings URL or an origin listed in trustedCredentialsOrigins;
• retry a request with browser credentials included (i.e. SSO / Windows Authentication) after an NTLM or Negotiate http 401 challenge only for origins explicitly listed in trustedCredentialsOrigins (the settings-URL origin is NOT implicitly trusted for SSO, since map-layer URLs may originate from untrusted user input while SSO shares the user's ambient identity). Default is false, preserving the legacy behavior of sending credentials to any request URL.

Defined in

• core/frontend/src/tile/map/MapLayerFormatRegistry.ts Line 171