openstreetmap / openstreetmap/mod_tile
Missing CORS in renderd.conf and 403 HTTP errors returned by mod_tile
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 318
- Forks
- 199
- PR merge metrics
- No merged PRs in 30d
Description
The current code taking care of CORS return 403 errors when the Origin header in the client request does not match the CORS=xxx parameter in renderd.conf or when this parameter is missing.
It does not seem logical as CORS is to be handled by the client, not by the server.
It could be seen as a way to limit access to the tileserver but in fact, this test is done by mod_tile AFTER calling renderd and generating the metatile.
I don't really understand the logic, that why I have no PR to offer so far.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the CORS handling in mod_tile and the related renderd.conf configuration, then reproduce requests with a matching, mismatching, and absent Origin header. Compare the current 403 behavior with the intended server-side behavior described in the issue. Done means the expected CORS cases no longer produce an inappropriate 403 after tile generation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- apache, cpp
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100