Strava heatmap authentication

[bertt]

Strava heatmaps after level 12 give now an error, for example:

$ curl https://heatmap-external-c.strava.com/tiles/all/hot/14/8423/5363.png
403: authentication is now required for data access beyond zoom level 12, please login to strava.com and then visit /auth

How to add this authentication stuff? Did a quick test retrieving tile with added tokens but no luck yet.

[alpterlab]

When used under WMTS on QGIS with
https://bertt.github.io/wmts/capabilities/strava.xml
I can see it between 0 and 13 zoom... From 14 onwards just disappear.... it does not state any errors ... just dont show it...

Used to work a couple of days ago thou....

[bertt]

yes here the blog describing the changes: https://blog.strava.com/press/heatmap-updates/

[bertt]

on site https://www.strava.com/heatmap#18.00/-119.26759/36.19952/blue/all I see a lot of 403 errors (Access denied) on detailed tile levels and after login.

Tiles are retrieved from tiles-auth route: https://heatmap-external-b.strava.com/tiles-auth/all/blue/16/11054/25688.png?v=19

[alpterlab]

@mbernasocchi any idea ? issue above ?
This seems still to be working ....
http://globalheat.strava.com/tiles/both/color1/{z}/{x}/{y}.png

Title: Strava Both
Credit: © Strava for tracing into OSM only
URL: http://globalheat.strava.com/tiles/both/color1/{z}/{x}/{y}.png
yOrigin: Top (yOriginTop=1)
Zoom range: 0 - 18
Layer Extent: Not set

It is coming form NextGIS... @simgislab any idea the issue above ?
https://github.com/nextgis/quickmapservices_contrib

[alpterlab]

strava/ec2metaproxy#1

[simgislab]

@alpter don't use contrib, rarely updated, use http://qms.nextgis.com, search for Strava, may be other sources would help better

[bertt]

the old heatmap (http://globalheat.strava.com/tiles/both/color1/0/0/0.png) still works but has less features and is not updated anymore i guess.

[andrea-del-sarto]

hi, you can try this https://heatmap-external-b.strava.com/tiles-auth/all/bluered/{zoom}/{x}/{y}.png?px=256
It should work

[bertt]

@andrea-del-sarto it gives an error, for example:

$ curl https://heatmap-external-b.strava.com/tiles-auth/all/bluered/14/8423/5363.png?px=256
<?xml version="1.0" encoding="UTF-8"?><Error><Code>MissingKey</Code><Message>Missing Key-Pair-Id query parameter or cookie value</Message></Error>

Question is: How to add a 'Key-Pair-Id query parameter'?

[alpterlab]

@andrea-del-sarto does not work....
I found this osmlab/editor-layer-index#373
on the last exchange they talk about "maximum zoom level" permitted and "authentication"...
...
for example
https://heatmap-external-c.strava.com/tiles/both/bluered/12/1505/2306.png

[alpterlab]

@tyrasd it seems we can not get the old version of the strava heatmap anymore below zoom 12/13.
Is there any solution ? In JOSM same problem...
https://bertt.github.io/wmts/capabilities/strava.xml

[alpterlab]

I guess we are stacked at present... until STRAVA / MAPBOX wont solve it...
https://josm.openstreetmap.de/ticket/16100

[andrea-del-sarto]

sorry, i've use it on osm id/strava id how custom background with strava login :(
anyway zoom level 12 work if use 256px version of the tiles
don't work > https://heatmap-external-c.strava.com/tiles/both/bluered/12/1505/2306.png
work > https://heatmap-external-c.strava.com/tiles/both/bluered/12/1505/2306.png?px=256

[alpterlab]

@mourner... see my comment here
Any way we can get around ?

exactly!Since the new Heat Map is being developed under​Mapbox GL they just need to set proper individual ​access tokens in order to associate requests to API resources with each personal STRAVA account. I guess... but... How long would it take ?
https://josm.openstreetmap.de/ticket/16100

[mourner]

@alpter as far as I know, Strava has their own heatmap implementation that is completely independent of ours. No idea how to help you here.

[tyrasd]

me neither, but maybe (hopefully) someone from @strava can tell us more about this issue, e.g. @drewrobb.

[scrapperuk]

keen to find a fix for this as an end user... I have a Strava login but cant apply the authentication to the iD editor..
I've even tried contacting the guy who developed this while at Strava, as its too cool to lose

will let you know if i hear anything (although I'm not a coder, so might have to use some plain English)

[alpterlab]

@inexcitus could you have a look at this issue... any idea ?

[alpterlab]

Thanks @scrapperuk @paulmach lets keep it up..
paulmach/slide#12

[StevenClays]

@bertt In JOSM its works, adding the cookies values by doing something like this >
tms[3,15]:https://heatmap-external-{switch:a,b,c}.strava.com/tiles-auth/both/bluered/{zoom}/{x}/{y}.png?Key-Pair-Id={my-value}&Signature={my-value}&Policy={my-value}
But how can I achieve the same result in QGIS? Thanks for helping me out

[bertt]

@StevenClays ah interesting, so only with cookie parameters in the request querystring (and not in the request headers)?

[StevenClays]

In JOSM this works, but I cannot get QGIS to do this. What could I be doing wrong? I'm not so acquainted with terms as 'request headers', in JOSM I just entered this link and it worked... @bartt

[bertt]

@StevenClays where did you get that url from?

[StevenClays]

@bertt In the JOSM-thread regarding this issue > https://josm.openstreetmap.de/ticket/16100

[bertt]

ok thanks :-) At the moment I don't know why QGIS doesn't work with this url but JOSM apparently does work.

[StevenClays]

@bertt Thanks for looking into it. Hopefully you can work it out...

[luiswoo]

Hi, is it possible to add gps tracks by Yandex (n.maps.yandex.ru)?
https://core-gpstiles.maps.yandex.net/tiles?style=point&x=37275&y=19294&z=16
https://core-gpstiles.maps.yandex.net/tiles?style=red_combined&x=37268&y=19297&z=16

"ygpx": { \
     "name": "yandex gps point",
     "prefix": "ygpx",			# tile directory
     "ext": "png",			# tile images extension
     "scalable": False,			# could zN tile be constructed of four z(N+1) tiles
     "fetch": fetchers.Tile,		# function that fetches given tile. should return None if tile wasn't fetched
     "remote_url": "https://gps-tiles.maps.yandex.net/tiles?style=point&x=%s&y=%s&z=%s",
     "transform_tile_number": lambda z,x,y: (x,y,z-1),
     "dead_tile": install_path + "yandex_nxt.jpg",
     "proj": "EPSG:3395",
},\
"ygpx_red_combined": { \
     "name": "yandex gps red_combined",
     "prefix": "ygpx_red_combined",		# tile directory
     "ext": "png",				# tile images extension
     "scalable": False,				# could zN tile be constructed of four z(N+1) tiles
     "fetch": fetchers.Tile,			# function that fetches given tile. should return None if tile wasn't fetched
     "remote_url": "https://gps-tiles.maps.yandex.net/tiles?style=red_combined&x=%s&y=%s&z=%s",
     "transform_tile_number": lambda z,x,y: (x,y,z-1),
     "dead_tile": install_path + "yandex_nxt.jpg",
     "proj": "EPSG:3395",
},\

^
this is for TWMS https://github.com/Komzpa/twms

https://n.maps.yandex.ru/#!/help?z=16&ll=24.740202%2C59.432151&l=nk%23sat

[nnngrach]

I have written a script to automatically log in to Strava and receiving of cookies. To do this, I used a Headless Chrome browser controlled by the Puppeteer script. Details and the script on this link:

https://github.com/nnngrach/strava_auto_auth

[Jochem-L]

@bertt In JOSM its works, adding the cookies values by doing something like this >
tms[3,15]:https://heatmap-external-{switch:a,b,c}.strava.com/tiles-auth/both/bluered/{zoom}/{x}/{y}.png?Key-Pair-Id={my-value}&Signature={my-value}&Policy={my-value}
But how can I achieve the same result in QGIS? Thanks for helping me out

I got it working in QGIS:

In Chrome, go to: https://www.strava.com/heatmap
Log in;
In Chrome, go to: chrome://settings/cookies/detail?site=strava.com
Click: CloudFrontKey-Pair-Id, CloudFrontPolicy and CloudFrontSignature
Copy-paste Content values to text editor;
In text editor, copy-paste URL:
https://heatmap-external-a.strava.com/tiles-auth/both/gray/{z}/{x}/{y}.png?v=19&Key-Pair-Id=APKAIDEUN4QMG7VUQPS
&Policy=eyJTdGE0ZW1lbnQiOiBbeyJSZXNvdXJjZSI6Imh0dHBzOi8vaGVhdG1hcC1leHRlcm5hbC0qLnN0cmF2YS5jb20vKiIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTU2OTMwOTc0NH0sIkRhdGVHcmVhdGVyVGhhbiI6eyJBV1M6RXBvY2hUaW1lIjoxNTY4MDg1NzQ0fX19XX0_
&Signature=dRuUDLEomc0j92k-CBPkktGLENwVrQKkuhQEeYGlGBmtRHIsm3lX-7kwqIH3QEsgquEB-wgL2O9g63rfl1JRxLgaAlF21UZeDp4YWSZGg5BMr6aDcH6zWjegGFEkQEqX8bGVgoBSobgDvmTICPtAMebpt3NxJHIFtL0R1yy6coS5d9JjsryTLknWFKZRg6i2QPOdTVURE1sRe82c2p36MFYFVKzlMC9srpnVZVQ2yN1JYxqn9Xld4PwUTFQcZFQngmv-vT31mUlLDiCkEcCrZaxNTpzCZc5zSMDtB-RvOhPD3vW9Q3dcVeP-9j93atB-BwyizEhlOuwOWeBsBQ__
Replace Key-Pair-Id, Policy and Signature values;
Remove the line breaks in the URL;
In QGIS, in browser panel: Right click, Choose New connection;
In dialog window: Type a free to choose name, Paste URL, Click OK;
In browser panel: Dubble click the name;
Repeat procedure when cookie is expired (1 week?).

[nnngrach]

Hi. I updated the API for my service to automatically access Strava tiles without authorization and replacing cookies. You can just use a URL like this:

https://anygis.ru/api/v1/Tracks_Strava_All/{x}/{y}/{z}

The full list of available URL maps can be found here:

https://github.com/nnngrach/strava_auto_auth

[KommandorKeen]

Fantastic, Jochem's solution worked for me. I have just copied the instructions into the layers metadata in QGIS in case I forget!

[pathexplorer]

Help,
strava cookies no longer contain these parameters!
CloudFront-Key-Pair-Id
CloudFront-Policy
CloudFront-Signature
How do I get access now?

[pdxvr]

I just cleared my Strava cookies and reloaded the page and I have all of those cookies back. I’m not sure what’s going on for you, but I still have them.

[pathexplorer]

Everything is working! The keys are apparently updated not immediately, and not after an hour, but after a few hours.

[Markus93-code]

Help, how can I import https://anygis.ru/api/v1/Tracks_Strava_All/{x}/{y}/{z} into QGis? Thanks

[dkselw]

@Jochem-L I got it working in QGIS:

This has been working for me until recently. Now QGIS is logging the following error:
WARNING Network request https://heatmap-external-a.strava.com/tiles-auth/both/gray/8/188/141.png?v=19&Key-Pair-Id= ... timed out

I can get it working with JOSM, but not QGIS.
I also tried getting the cookie info with the Firefox and Chrome plugins from here: https://github.com/zekefarwell/josm-strava-heatmap

[dkselw]

@Jochem-L I got it working in QGIS:

This has been working for me until recently. Now QGIS is logging the following error: WARNING Network request https://heatmap-external-a.strava.com/tiles-auth/both/gray/8/188/141.png?v=19&Key-Pair-Id= ... timed out

I can get it working with JOSM, but not QGIS. I also tried getting the cookie info with the Firefox and Chrome plugins from here: https://github.com/zekefarwell/josm-strava-heatmap

And now 4 days later I opened QGIS and the heatmap appeared without changing anything.

[dkselw]

The manual method of creating the URL described by @Jochem-L is working for me again.

The Firefox and Chrome plugins from here: https://github.com/zekefarwell/josm-strava-heatmap are also working for me to get the URL with cookie info:
I changed the start of the line from:
tms:https://heatmap-external-{switch:a,b,c}.strava.com/tiles-auth/all/hot/{zoom}/{x}/{y}.png
to
https://heatmap-external-a.strava.com/tiles-auth/all/hot/{z}/{x}/{y}.png

[Jochem-L]

Hi. I updated the API for my service to automatically access Strava tiles without authorization and replacing cookies. You can just use a URL like this:

https://anygis.ru/api/v1/Tracks_Strava_All/{x}/{y}/{z}

@nnngrach, It seems like your service has been down for quite some time. It would be great if you could fix that. In any case, thanks for keeping this service up for so long. It gave me a lot of valuable information during hikes and I am missing this dearly.

[patrickziegler]

Hi guys, I had the same problem and found lots of helpful pointers in this thread, thanks a lot! You might be interested in checking out https://github.com/patrickziegler/strava-heatmap-proxy

[Jochem-L]

Alternatively, to get Strava Heatmap in QGIS without installing a proxy server

• In Chrome, go to https://www.strava.com/heatmap

• Log in;

• Right-click the Strava logo and choose "Inspect";

• In top menu of DevTools, choose "Application";

• In left panel, fold out "Cookies" and click strava.com;

• Copy values of "CloudFront-Key-Pair-Id", "CloudFront-Policy" and "CloudFront-Signature";

• Paste these values to a text editor;

• In the text editor, copy-paste this URL:
  https://heatmap-external-a.strava.com/tiles-auth/all/hot/{z}/{x}/{y}.png?v=19&Key-Pair-Id=...&Policy=...&Signature=...

• Replace the ... of "Key-Pair-Id", "Policy" and "Signature values" in the URL with your values;

• Optionally, replace the all in the URL with ride, run, water or winter;

• Optionally, replace the hot in the URL with blue, purple, gray or bluered;

• In QGIS, in browser panel, right click, "Choose New connection";

• In dialog window, type a free to choose name, paste URL and click "OK";

• In browser panel, double click the name;

• Repeat procedure when cookie is expired.

[patrickziegler]

@Jochem-L you are right, the sequence you posted above gave me the idea to add a slightly redesigned tool described in https://github.com/patrickziegler/strava-heatmap-proxy#using-the-static-file-configurator

Your example above would then boil down to the following line, which will replace all %CloudFront-*% tokens right away and print out the line you need for the connection in QGIS, no proxy needed

echo "https://heatmap-external-a.strava.com/tiles-auth/all/hot/%7Bz%7D/%7Bx%7D/%7By%7D.png?v=19&Key-Pair-Id=%CloudFront-Key-Pair-Id%&Policy=%CloudFront-Policy%&Signature=%CloudFront-Signature%" | strava-heatmap-auth

[Jochem-L]

Nice!

Unfortunately, I have some problems to get it working. I think I managed to compile strava-heatmap-auth in Windows using Anaconda Prompt. But now strava-heatmap-auth is looking for a config.json it can't find.

[patrickziegler]

@Jochem-L thanks for trying it

that config file is described in https://github.com/patrickziegler/strava-heatmap-proxy#wrench-configuration it holds the strava login credentials in the form

{"Email": "...", "Password": "..."}

with that in place, you can use it in a custom location with

echo "..." | strava-heatmap-auth --config "<path-to-your-config>"

[Jochem-L]

Thanks it works! Sorry for not RTFM ;-) I expected a more complicated config file with a dummy in the github repository.

I am really happy with it, as it works not only for URLs, but for entire XML files too (I use these for configuring Strava Heatmap also in the app All-in-one Offlinemaps).

[Jochem-L]

@patrickziegler, Your tool works for me only if I login to Strava manually first. It seems to use old Cloud-front values, if I don't. I expected the tool to do the new login too, since it needs the config file with login credentials. Do you have any ideas what goes wrong? Note that I'm running it under Windows 10 at the moment, but I might try Android 13 later too.

Edit: I'm not sure what I did wrong. It worked when I tried again. I'm using it now for some time without problems.

[patrickziegler]

@Jochem-L the configurator strava-heatmap-auth will perform a login on every startup (using the credentials you provide in the config). This is completely independent from what you do in your browser, the tool does not even look at any of your systems files or caches (apart from the config file of course).

However, as stated in the readme, the cloudfront tokens are expiring after around a week and you will need to manually re-create your TMS files accordingly after that time period.

Feel free to open an issue here https://github.com/patrickziegler/strava-heatmap-proxy/issues if you discover a bug, it would be highly appreciated, but I guess @bertt will not be happy if we continue discussing these things in his thread 😄