Styles and assets

A MapLibre style is a dependency graph, not a self-contained colour palette. Rendering may require the style JSON, vector or raster tile sources, TileJSON, glyph ranges, sprites, and images referenced by layers.

Style requirements

• Use an absolute HTTP(S) style URL reachable from the WMS-VT server.
• Ensure every source and asset URL can be resolved relative to that style.
• Verify that the style is valid for the MapLibre renderer version in use.
• Remove interactive-only layers or expressions that are not meaningful in a static output, where appropriate.
• Test labels, icons, patterns, and source attribution—not only roads and polygons.

Provider credentials

Many hosted styles contain a provider key in the style URL or referenced asset URLs. Follow the provider's terms and origin restrictions. Do not publish that URL in documentation, logs, issue reports, or browser-side demo code.

WMS-VT's stored style alias mechanism can keep the literal style URL out of normal client requests when configured for an API key.

Glyphs and sprites

The TypeScript service can rewrite style glyph and sprite URLs through same-origin proxy endpoints. This avoids browser-side CORS failures during its rendering flow, but it does not grant access to a private upstream resource or change its licence.

If labels or icons are missing:

1. Fetch the style URL from the rendering host.
2. Resolve and fetch its glyph and sprite URLs with the same credentials.
3. Check the service logs for upstream HTTP errors.
4. Test whether the provider permits server-side use.
5. Confirm the style is being routed through WMS-VT's style rewriting path where required.

Security boundary

Allowing arbitrary server-side URLs introduces server-side request forgery and data-exfiltration risk. A production live demo should use approved styles or an allowlist and should reject private, loopback, link-local, and unsupported network destinations.