@vis.gl/react-google-maps using new domain 'https://mapsresources-pa.googleapis.com' which is different from official one https://maps.googleapis.com

[jeevakirtan-fs]

We have integrated Google Maps into our React application using the @vis.gl/react-google-maps package. Our Content Security Policy (CSP) is configured according to Google's documentation, specifically whitelisting maps.googleapis.com.

We did not make any changes to our application or upgrade any related packages. However, we recently encountered an issue where Google Maps stopped rendering due to the following CSP error:

webgl.js:44 Refused to create a worker from 'blob:http://localhost:3000/...' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' https://maps.googleapis.com". Note that 'worker-src' was not explicitly set, so 'script-src' is used as a fallback.

main.js:154 Attempted to load a Vector Map, but failed. Falling back to Raster. Please see https://developers.google.com/maps/documentation/javascript/webgl/support for more info.
build-on-map:1 Refused to load the image 'https://mapsresources-pa.googleapis.com/v1/tiles?...' because it violates the following Content Security Policy directive: "img-src 'self' https://maps.googleapis.com https://maps.gstatic.com

After updating our CSP policy to include "https://mapresources-pa.googleapis.com/", the issue was resolved. However, we would like to understand why this change was necessary and this domain is not mentioned in official google docs

There were no package upgrades or changes on our end.

We couldn't find any release notes or documentation updates mentioning this change.

[usefulthink]

I've got to say that I'm not too familiar with CSP myself, but according to the official guide here you should have a worker-src blob: in your CSP (this seems to be missing, according to the first error-message). The part with 'attempting to load the vector-map...' is likely related to this.

Then you seem to have an img-src policy that is too strict. Again, according to the linked guide, that should also include *.googleapis.com.

As far as the documentation on developers.google.com is concerned, that is out of scope for this library. If there are inaccuracies or misleading information, the folks at google will certainly fix it, so let them know by creating an issue here: https://issuetracker.google.com/issues?q=status:open%20componentid:188853&s=created_time:desc

[jeevakirtan-fs]

Thanks for the quick response.

it was error due to wrong mapId. Not issue with google API