Skip to content

Commit a839d0b

Browse files
fmigneaultfmigneault
authored
add BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN setting (#611)
## Overview Add `BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN` setting. ## Changes **Non-breaking changes** - Proxy: Allow `Access-Control-Allow-Origin` header to be configured using `BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN` variable. - The `cors.include` file is converted to a `cors.include.template` file to allow variable expansion. - The default `BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN="*"` is used to retain the previous behaviour. - The `BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN` variable can reference other variables to allow dynamic configuration (notably, to reference `BIRDHOUSE_FQDN_PUBLIC` for same-origin allowance). - Align the documentation with corresponding `STAC_CORS_ORIGINS` header implications. - Avoids Nginx warnings flagged from using uninitialized `access_control_allow_origin` variable.
2 parents d1c6f96 + 1ac6181 commit a839d0b

File tree

15 files changed

+129
-63
lines changed

15 files changed

+129
-63
lines changed

‎.bumpversion.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
[tool.bumpversion]
2-
current_version = "2.18.15"
2+
current_version = "2.18.16"
33
commit = true
44
tag = false
55
tag_name = "{new_version}"

‎CHANGES.md‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,27 @@
1717

1818
[//]: # (list changes here, using '-' for each new entry, remove this when items are added)
1919

20+
[2.18.16](https://github.com/bird-house/birdhouse-deploy/tree/2.18.16) (2025-12-05)
21+
------------------------------------------------------------------------------------------------------------------
22+
23+
## Changes
24+
25+
- Proxy: Allow `Access-Control-Allow-Origin` header to be configured using `BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN` variable.
26+
- A `defaults.include.template` file is introduced to setup global nginx server defaults that can be overridden
27+
by more specialized definitions in `location` blocks of components.
28+
- The default `BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN="*"` is used to retain the previous behaviour.
29+
- The `BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN` variable can reference other variables to allow dynamic configuration
30+
(notably, to reference `BIRDHOUSE_FQDN_PUBLIC` for same-origin allowance).
31+
- Align the documentation with corresponding `STAC_CORS_ORIGINS` header implications.
32+
- Avoids Nginx warnings flagged from using uninitialized `access_control_allow_origin` variable
33+
(fixes https://github.com/bird-house/birdhouse-deploy/issues/610).
34+
2035
[2.18.15](https://github.com/bird-house/birdhouse-deploy/tree/2.18.15) (2025-12-01)
2136
------------------------------------------------------------------------------------------------------------------
2237

2338
## Changes
2439

25-
- README: remind the user to source control `env.local` securely as it may contains passwords.
40+
- README: remind the user to source control `env.local` securely as it may contain passwords.
2641

2742
## Fixes
2843

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ override BIRDHOUSE_MAKE_DIR := $(shell realpath -P $$(dirname $(BIRDHOUSE_MAKE_C
88
# Generic variables
99
override SHELL := bash
1010
override APP_NAME := birdhouse-deploy
11-
override APP_VERSION := 2.18.15
11+
override APP_VERSION := 2.18.16
1212

1313
# utility to remove comments after value of an option variable
1414
override clean_opt = $(shell echo "$(1)" | $(_SED) -r -e "s/[ '$'\t'']+$$//g")

‎README.rst‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ for a full-fledged production platform.
1818
* - citation
1919
- | |citation|
2020

21-
.. |commits-since| image:: https://img.shields.io/github/commits-since/bird-house/birdhouse-deploy/2.18.15.svg
21+
.. |commits-since| image:: https://img.shields.io/github/commits-since/bird-house/birdhouse-deploy/2.18.16.svg
2222
:alt: Commits since latest release
23-
:target: https://github.com/bird-house/birdhouse-deploy/compare/2.18.15...master
23+
:target: https://github.com/bird-house/birdhouse-deploy/compare/2.18.16...master
2424

25-
.. |latest-version| image:: https://img.shields.io/badge/tag-2.18.15-blue.svg?style=flat
25+
.. |latest-version| image:: https://img.shields.io/badge/tag-2.18.16-blue.svg?style=flat
2626
:alt: Latest Tag
27-
:target: https://github.com/bird-house/birdhouse-deploy/tree/2.18.15
27+
:target: https://github.com/bird-house/birdhouse-deploy/tree/2.18.16
2828

2929
.. |readthedocs| image:: https://readthedocs.org/projects/birdhouse-deploy/badge/?version=latest
3030
:alt: ReadTheDocs Build Status (latest version)

‎RELEASE.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2.18.15 2025-12-01T18:03:36Z
1+
2.18.16 2025-12-05T19:37:01Z

‎birdhouse/components/README.rst‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -723,24 +723,26 @@ How to Enable the Component
723723
STAC Browser
724724
============
725725
726-
STAC Browser is a web UI used to interact with the STAC API.
726+
STAC Browser is a web UI used to interact with the STAC API.
727727
728728
Usage
729729
-----
730730
731-
The STAC API can be browsed via the ``stac-browser`` component. By default, the browser will point to the STAC API
731+
The STAC API can be browsed via the ``stac-browser`` component. By default, the browser will point to the STAC API
732732
exposed by the current ``components/stac`` service.
733-
Once this component is enabled, the STAC browser will be available at the ``https://<BIRDHOUSE_FQDN_PUBLIC>/stac-browser``
734-
endpoint
733+
Once this component is enabled, the STAC browser will be available
734+
at the ``https://<BIRDHOUSE_FQDN_PUBLIC>/stac-browser`` endpoint.
735735
736-
If your STAC API contains geojson data, it is recommended to set the ``STAC_CORS_ORIGINS`` value to accept the origin
737-
``https://geojson.io`` since the STAC Browser offers a link to open geojson data at this URL.
736+
If your STAC API contains GeoJSON data, it is recommended to set the ``STAC_CORS_ORIGINS`` value to accept the origin
737+
``https://geojson.io`` since the STAC Browser offers a link to open GeoJSON data at this URL.
738738
Note that you do not need to change the ``STAC_CORS_ORIGINS`` value from the default (which accepts all origins), but
739739
if you have changed it please update it to include this origin as well.
740+
If using ``BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN`` overrides, it is also recommended to reference its value within
741+
``STAC_CORS_ORIGINS`` to ensure consistency across the stack.
740742
741743
For example:
742744
743-
.. code::shell
745+
.. code-block:: shell
744746
745747
# If the STAC_CORS_ORIGINS is currently
746748
export STAC_CORS_ORIGINS='http://example.com ~http:(www|other)\.api\.example\.com'

‎birdhouse/components/canarie-api/docker_configuration.py.template‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -108,8 +108,8 @@ SERVICES = {
108108
# NOTE:
109109
# Below version and release time auto-managed by 'make VERSION=x.y.z bump'.
110110
# Do NOT modify it manually. See 'Tagging policy' in 'birdhouse/README.rst'.
111-
'version': '2.18.15',
112-
'releaseTime': '2025-12-01T18:03:36Z',
111+
'version': '2.18.16',
112+
'releaseTime': '2025-12-05T19:37:01Z',
113113
'institution': '${BIRDHOUSE_INSTITUTION}',
114114
'researchSubject': '${BIRDHOUSE_SUBJECT}',
115115
'supportEmail': '${BIRDHOUSE_SUPPORT_EMAIL}',
@@ -141,8 +141,8 @@ PLATFORMS = {
141141
# NOTE:
142142
# Below version and release time auto-managed by 'make VERSION=x.y.z bump'.
143143
# Do NOT modify it manually. See 'Tagging policy' in 'birdhouse/README.rst'.
144-
'version': '2.18.15',
145-
'releaseTime': '2025-12-01T18:03:36Z',
144+
'version': '2.18.16',
145+
'releaseTime': '2025-12-05T19:37:01Z',
146146
'institution': '${BIRDHOUSE_INSTITUTION}',
147147
'researchSubject': '${BIRDHOUSE_SUBJECT}',
148148
'supportEmail': '${BIRDHOUSE_SUPPORT_EMAIL}',

‎birdhouse/components/proxy/conf.d/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
frontend.conf
22
all-services.include
3+
defaults.include
34

45
# from private config
56
lb_catalog.conf

‎birdhouse/components/proxy/conf.d/all-services.include.template‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,8 @@
3434
return 302 ${BIRDHOUSE_DOC_URL};
3535
}
3636

37+
# server defaults if not overridden in specific location blocks
38+
include /etc/nginx/conf.d/defaults.include;
39+
3740
# for other extra components to extend Nginx
3841
include /etc/nginx/conf.extra-service.d/*/*.conf;

‎birdhouse/components/proxy/conf.d/cors.include‎

Lines changed: 40 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,43 @@
1-
proxy_hide_header 'Access-Control-Allow-Origin';
1+
proxy_hide_header 'Access-Control-Allow-Origin';
22

3-
if ( $access_control_allow_origin ~ "^$" ) {
4-
set $access_control_allow_origin '*';
5-
}
3+
# assumes that the server default is configured or overriden by a specific location block as needed
4+
# if explicitly set to empty, align it with the standard value allowing any origin
5+
if ( $access_control_allow_origin ~ "^$" ) {
6+
set $access_control_allow_origin '*';
7+
}
68

7-
set $vary_origin ""; # nginx will omit this header value if set to the empty string
8-
if ( $access_control_allow_origin != '*' ) {
9-
set $vary_origin Origin;
10-
}
9+
set $vary_origin ""; # nginx will omit this header value if set to the empty string
10+
if ( $access_control_allow_origin != '*' ) {
11+
set $vary_origin Origin;
12+
}
1113

12-
if ($request_method = 'OPTIONS') {
13-
add_header 'Access-Control-Allow-Origin' $access_control_allow_origin;
14-
add_header Vary $vary_origin;
15-
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
16-
#
17-
# Custom headers and headers various browsers *should* be OK with but aren't
18-
#
19-
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
20-
#
21-
# Tell client that this pre-flight info is valid for 20 days
22-
#
23-
add_header 'Access-Control-Max-Age' 1728000;
24-
add_header 'Content-Type' 'text/plain; charset=utf-8';
25-
add_header 'Content-Length' 0;
26-
return 204;
27-
}
28-
if ($request_method = 'POST') {
29-
add_header 'Access-Control-Allow-Origin' $access_control_allow_origin;
30-
add_header Vary $vary_origin;
31-
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
32-
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
33-
add_header 'Access-Control-Expose-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
34-
}
35-
if ($request_method = 'GET') {
36-
add_header 'Access-Control-Allow-Origin' $access_control_allow_origin;
37-
add_header Vary $vary_origin;
38-
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
39-
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
40-
add_header 'Access-Control-Expose-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
41-
}
14+
if ($request_method = 'OPTIONS') {
15+
add_header 'Vary' $vary_origin;
16+
add_header 'Access-Control-Allow-Origin' $access_control_allow_origin;
17+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
18+
#
19+
# Custom headers and headers various browsers *should* be OK with but aren't
20+
#
21+
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
22+
#
23+
# Tell client that this pre-flight info is valid for 20 days
24+
#
25+
add_header 'Access-Control-Max-Age' 1728000;
26+
add_header 'Content-Type' 'text/plain; charset=utf-8';
27+
add_header 'Content-Length' 0;
28+
return 204;
29+
}
30+
if ($request_method = 'POST') {
31+
add_header 'Vary' $vary_origin;
32+
add_header 'Access-Control-Allow-Origin' $access_control_allow_origin;
33+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
34+
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
35+
add_header 'Access-Control-Expose-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
36+
}
37+
if ($request_method = 'GET') {
38+
add_header 'Vary' $vary_origin;
39+
add_header 'Access-Control-Allow-Origin' $access_control_allow_origin;
40+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
41+
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
42+
add_header 'Access-Control-Expose-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
43+
}

0 commit comments

Comments
 (0)