mirror of
https://github.com/home-assistant/frontend.git
synced 2026-10-01 17:29:02 +01:00
The access token rotates every half hour and lives in the query string, so it is part of the browser's cache key: every rotation orphans every cached tile, and the week-long max-age core sends is worth nothing. The service worker works around it by stripping the token from its own cache key, but a service worker only runs on https or localhost - on a plain http LAN origin, which is how a lot of instances and the companion apps are reached, there is no cache at all between the map and the network. Anything that can set a header sends the token there instead, which leaves the URL, and with it the cache key, stable across rotations. Raster tiles come from an <img> and stay on the query parameter, and so does Cast: cross-origin a custom header would cost a CORS preflight per tile. Needs the matching core change; against a core without it the proxy refuses every tile. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>