add BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN setting
#611
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
documentation
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3837/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : add-cors-origin DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-216.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/546/NOTEBOOK TEST RESULTS |
tlvu
requested changes
Nov 27, 2025
Collaborator
tlvu
left a comment
tlvu
left a comment
There was a problem hiding this comment.
A few minor changes requested but looks good otherwise.
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3846/Result ❌ FAILUREBIRDHOUSE_DEPLOY_BRANCH : add-cors-origin DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-216.rdext.crim.ca PAVICS-e2e-workflow-tests Pipeline ResultsTests URL : http://daccs-jenkins.crim.ca:80/job/PAVICS-e2e-workflow-tests/job/master/551/NOTEBOOK TEST RESULTS |
mishaschwartz
requested changes
Dec 1, 2025
tlvu
requested changes
Dec 1, 2025
Collaborator
tlvu
left a comment
tlvu
left a comment
There was a problem hiding this comment.
Duplicate BIRDHOUSE_SSL_CERTIFICATE
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3855/Result 🆘 ABORTEDBIRDHOUSE_DEPLOY_BRANCH : add-cors-origin DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-91.rdext.crim.ca
|
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3854/Result 🆘 ABORTEDBIRDHOUSE_DEPLOY_BRANCH : add-cors-origin DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-91.rdext.crim.ca
|
mishaschwartz
requested changes
Dec 1, 2025
| if ( $access_control_allow_origin ~ "^$" ) { | ||
| set $access_control_allow_origin '*'; | ||
| } | ||
| # assumes that the server default is configured or overriden by a specific locaiton block as needed |
Collaborator
There was a problem hiding this comment.
Is this if block needed anymore?
Member
Author
There was a problem hiding this comment.
I think so because the value could still be set explicitly (or resolved from variable expansions) to ''.
mishaschwartz
approved these changes
Dec 2, 2025
| # Set to "*" to allow all origins by default | ||
| # If you want to restrict access, set this to the space-delimited allowed domain(s) | ||
| # Can use other variables if needed (e.g.: '${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}') | ||
| export BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN="*" |
Collaborator
There was a problem hiding this comment.
One very small last thing:
Can we add a note here that reminds the user that if this is unset (or set to the empty string) then it will default to "*" (because of the if block in cors.include).
That might be something that would surprise users if they haven't looked too closely at cors.include
Collaborator
There was a problem hiding this comment.
On the other hand, if the user explicitly override it to empty string in env.local, maybe he wants to not allow '*' and if we still set to '*' in cors.include, is that a good thing?!
Is there any scenarios where the user really want that value to be empty string and we should not block that?
Member
Author
There was a problem hiding this comment.
If you set '' to the CORS header, it is just wrong (not one of its permitted standard values). It will unset the header in nginx response, while still sending mixed signals since other Access-Control-... headers would be present. Also, since set $vary_origin Origin; is set when != *, it would indicate that the result varies based on Origin, but doesn't actually perform that varying response.
I think overall, unless you list specific origins to allow, the intent is always *.
I will add the note though about auto-fix just to be explicit about it.
tlvu
approved these changes
Dec 3, 2025
Collaborator
tlvu
left a comment
tlvu
left a comment
There was a problem hiding this comment.
Good for me know. Minor question about whether we should allow the user to override to empty string.
| if ( $access_control_allow_origin ~ "^$" ) { | ||
| set $access_control_allow_origin '*'; | ||
| } | ||
| # assumes that the server default is configured or overriden by a specific locaiton block as needed |
| # Set to "*" to allow all origins by default | ||
| # If you want to restrict access, set this to the space-delimited allowed domain(s) | ||
| # Can use other variables if needed (e.g.: '${BIRDHOUSE_PROXY_SCHEME}://${BIRDHOUSE_FQDN_PUBLIC}') | ||
| export BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN="*" |
Collaborator
There was a problem hiding this comment.
On the other hand, if the user explicitly override it to empty string in env.local, maybe he wants to not allow '*' and if we still set to '*' in cors.include, is that a good thing?!
Is there any scenarios where the user really want that value to be empty string and we should not block that?
Collaborator
By the way, I think you could have avoided all the diff noise if you Bonus Git an auto detect a rename if the change is small. But if you also fix indentations within the same change, git will see a large diff and will think it's a new file, unrelated to the old name. |
2 tasks
Member
Author
It wasn't done in one step on my end. It was multiple commits spread out over a few days. |
Collaborator
Yes, I didn't mean for you to fix it now, too late now. I mean next time, if you do the rename in 2 commits (one commit just for rename, and one commit to modify the file content), the diff will be cleaner and we preserve the rename history. |
tlvu
approved these changes
Dec 4, 2025
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3858/Result 🆘 ABORTEDBIRDHOUSE_DEPLOY_BRANCH : add-cors-origin DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-91.rdext.crim.ca
|
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3857/Result 🆘 ABORTEDBIRDHOUSE_DEPLOY_BRANCH : add-cors-origin DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-154.rdext.crim.ca
|
Collaborator
E2E Test ResultsDACCS-iac Pipeline ResultsBuild URL : http://daccs-jenkins.crim.ca:80/job/DACCS-iac-birdhouse/3856/Result 🆘 ABORTEDBIRDHOUSE_DEPLOY_BRANCH : add-cors-origin DACCS_IAC_BRANCH : master DACCS_CONFIGS_BRANCH : master PAVICS_E2E_WORKFLOW_TESTS_BRANCH : master PAVICS_SDI_BRANCH : master DESTROY_INFRA_ON_EXIT : true PAVICS_HOST : https://host-140-216.rdext.crim.ca
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
Add
BIRDHOUSE_PROXY_CORS_ALLOW_ORIGINsetting.Note
The
cors.include.templatediff looks massive, but the actual concrete change is only adding:Changes
Non-breaking changes
Access-Control-Allow-Originheader to be configured usingBIRDHOUSE_PROXY_CORS_ALLOW_ORIGINvariable.cors.includefile is converted to acors.include.templatefile to allow variable expansion.BIRDHOUSE_PROXY_CORS_ALLOW_ORIGIN="*"is used to retain the previous behaviour.BIRDHOUSE_PROXY_CORS_ALLOW_ORIGINvariable can reference other variables to allow dynamic configuration(notably, to reference
BIRDHOUSE_FQDN_PUBLICfor same-origin allowance).STAC_CORS_ORIGINSheader implications.access_control_allow_originvariable.Breaking changes
Related Issue / Discussion
CI Operations
birdhouse_daccs_configs_branch: master
birdhouse_skip_ci: false