Skip to content
This repository was archived by the owner on Mar 25, 2022. It is now read-only.

Commit 081ff78

Browse files
author
Lars Gierth
committed
gateway: fix setting CORS headers, for real this time
License: MIT Signed-off-by: Lars Gierth <[email protected]>
1 parent 7f7de20 commit 081ff78

File tree

4 files changed

+185
-113
lines changed

4 files changed

+185
-113
lines changed

‎ipfs/config.tpl

+2-10
Original file line numberDiff line numberDiff line change
@@ -54,18 +54,10 @@
5454
"PathPrefixes": ["/blog", "/refs"],
5555
"RootRedirect": "",
5656
"Writable": false,
57-
"HTTPHeaders": {
58-
"Access-Control-Allow-Origin": ["*"],
59-
"Access-Control-Allow-Methods": ["GET", "POST", "PUT"],
60-
"Access-Control-Allow-Headers": ["X-Requested-With", "Range"]
61-
}
57+
"HTTPHeaders": {}
6258
},
6359
"API": {
64-
"HTTPHeaders": {
65-
"Access-Control-Allow-Origin": ["*"],
66-
"Access-Control-Allow-Methods": ["GET", "POST", "PUT"],
67-
"Access-Control-Allow-Headers": ["X-Requested-With", "Range"]
68-
}
60+
"HTTPHeaders": {}
6961
},
7062
"DialBlocklist": null,
7163
"Swarm": {

‎ipfs/gateway/nginx.conf

+180
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ $(for h in $(lookup gateway_hosts); do
88
done)
99
}
1010

11+
upstream ws_bootstrap {
12+
server 127.0.0.1:8081;
13+
}
14+
1115
# TODO set proper port in Host headers,
1216
# we're just working around libp2p/go-ws-transport#8 for now.
1317

@@ -20,6 +24,11 @@ server {
2024

2125
include conf.d/gateway/denylist.conf;
2226

27+
add_header 'Access-Control-Allow-Origin' '*' always;
28+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
29+
add_header 'Access-Control-Allow-Headers' 'X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output' always;
30+
add_header 'Access-Control-Expose-Headers' 'Content-Range, X-Chunked-Output, X-Stream-Output' always;
31+
2332
proxy_pass_header Server;
2433
proxy_read_timeout 1800s;
2534

@@ -39,6 +48,11 @@ server {
3948

4049
include conf.d/gateway/denylist.conf;
4150

51+
add_header 'Access-Control-Allow-Origin' '*' always;
52+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
53+
add_header 'Access-Control-Allow-Headers' 'X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output' always;
54+
add_header 'Access-Control-Expose-Headers' 'Content-Range, X-Chunked-Output, X-Stream-Output' always;
55+
4256
proxy_pass_header Server;
4357
proxy_read_timeout 1800s;
4458

@@ -62,6 +76,11 @@ server {
6276

6377
include conf.d/gateway/denylist.conf;
6478

79+
add_header 'Access-Control-Allow-Origin' '*' always;
80+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
81+
add_header 'Access-Control-Allow-Headers' 'X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output' always;
82+
add_header 'Access-Control-Expose-Headers' 'Content-Range, X-Chunked-Output, X-Stream-Output' always;
83+
6584
proxy_pass_header Server;
6685
proxy_read_timeout 1800s;
6786

@@ -87,6 +106,11 @@ server {
87106
# 31536000 seconds = 12 months, as advised by hstspreload.org
88107
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
89108

109+
add_header 'Access-Control-Allow-Origin' '*' always;
110+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
111+
add_header 'Access-Control-Allow-Headers' 'X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output' always;
112+
add_header 'Access-Control-Expose-Headers' 'Content-Range, X-Chunked-Output, X-Stream-Output' always;
113+
90114
include conf.d/gateway/denylist.conf;
91115

92116
proxy_pass_header Server;
@@ -114,6 +138,11 @@ server {
114138
# 31536000 seconds = 12 months, as advised by hstspreload.org
115139
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
116140

141+
add_header 'Access-Control-Allow-Origin' '*' always;
142+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
143+
add_header 'Access-Control-Allow-Headers' 'X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output' always;
144+
add_header 'Access-Control-Expose-Headers' 'Content-Range, X-Chunked-Output, X-Stream-Output' always;
145+
117146
include conf.d/gateway/denylist.conf;
118147

119148
proxy_pass_header Server;
@@ -147,6 +176,152 @@ server {
147176
}
148177
}
149178

179+
server {
180+
server_name $(var pages_bootstrap_hostname).bootstrap.libp2p.io;
181+
access_log /var/log/nginx/access.log mtail;
182+
183+
listen 443 ssl;
184+
listen [::]:443 ssl;
185+
ssl_certificate /etc/nginx/certs/bootstrap.libp2p.io.crt;
186+
ssl_certificate_key /etc/nginx/certs/bootstrap.libp2p.io.key;
187+
ssl_dhparam /etc/nginx/certs/bootstrap.libp2p.io.dhparam.pem;
188+
ssl_trusted_certificate /etc/nginx/certs/bootstrap.libp2p.io.trustchain.crt;
189+
190+
# HSTS (ngx_http_headers_module is required)
191+
# 31536000 seconds = 12 months, as advised by hstspreload.org
192+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
193+
194+
add_header 'Access-Control-Allow-Origin' '*' always;
195+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
196+
add_header 'Access-Control-Allow-Headers' 'X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output' always;
197+
add_header 'Access-Control-Expose-Headers' 'Content-Range, X-Chunked-Output, X-Stream-Output' always;
198+
199+
location / {
200+
proxy_set_header Host $(var pages_bootstrap_hostname).bootstrap.libp2p.io:443;
201+
proxy_set_header Upgrade \$http_upgrade;
202+
proxy_set_header Connection \$http_connection;
203+
proxy_set_header Sec-WebSocket-Key \$http_sec_websocket_key;
204+
proxy_set_header Sec-WebSocket-Extensions \$http_sec_websocket_extensions;
205+
proxy_set_header Sec-WebSocket-Version \$http_sec_websocket_version;
206+
proxy_pass http://ws_bootstrap;
207+
proxy_pass_header Server;
208+
proxy_read_timeout 60s;
209+
}
210+
}
211+
212+
server {
213+
server_name *.preload.ipfs.io;
214+
access_log /var/log/nginx/access.log mtail;
215+
216+
listen 443 ssl;
217+
listen [::]:443 ssl;
218+
ssl_certificate /etc/nginx/certs/preload.ipfs.io.crt;
219+
ssl_certificate_key /etc/nginx/certs/preload.ipfs.io.key;
220+
ssl_dhparam /etc/nginx/certs/preload.ipfs.io.dhparam.pem;
221+
ssl_trusted_certificate /etc/nginx/certs/preload.ipfs.io.trustchain.crt;
222+
223+
# HSTS (ngx_http_headers_module is required)
224+
# 31536000 seconds = 12 months, as advised by hstspreload.org
225+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
226+
227+
add_header 'Access-Control-Allow-Origin' '*' always;
228+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
229+
add_header 'Access-Control-Allow-Headers' 'X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output' always;
230+
add_header 'Access-Control-Expose-Headers' 'Content-Range, X-Chunked-Output, X-Stream-Output' always;
231+
232+
location /ipfs {
233+
proxy_set_header Host \$host:443;
234+
proxy_set_header X-Ipfs-Gateway-Prefix "";
235+
proxy_pass http://gateway;
236+
}
237+
238+
location /ipns {
239+
proxy_set_header Host \$host:443;
240+
proxy_set_header X-Ipfs-Gateway-Prefix "";
241+
proxy_pass http://gateway;
242+
}
243+
244+
location /api {
245+
proxy_set_header Host \$host:443;
246+
proxy_set_header X-Ipfs-Gateway-Prefix "";
247+
proxy_pass http://gateway;
248+
}
249+
250+
location / {
251+
proxy_set_header Host \$host:80;
252+
proxy_set_header Upgrade \$http_upgrade;
253+
proxy_set_header Connection \$http_connection;
254+
proxy_set_header Sec-WebSocket-Key \$http_sec_websocket_key;
255+
proxy_set_header Sec-WebSocket-Extensions \$http_sec_websocket_extensions;
256+
proxy_set_header Sec-WebSocket-Version \$http_sec_websocket_version;
257+
proxy_pass http://ws_bootstrap;
258+
proxy_pass_header Server;
259+
proxy_read_timeout 60s;
260+
}
261+
}
262+
263+
server {
264+
server_name js.ipfs.io;
265+
266+
listen 443 ssl;
267+
listen [::]:443 ssl;
268+
ssl_certificate /etc/nginx/certs/ipfs.io.crt;
269+
ssl_certificate_key /etc/nginx/certs/ipfs.io.key;
270+
ssl_dhparam /etc/nginx/certs/dhparam.pem;
271+
ssl_trusted_certificate /etc/nginx/certs/ipfs.io.trustchain.crt;
272+
273+
# HSTS (ngx_http_headers_module is required)
274+
# 31536000 seconds = 12 months, as advised by hstspreload.org
275+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
276+
277+
add_header 'Access-Control-Allow-Origin' '*' always;
278+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
279+
add_header 'Access-Control-Allow-Headers' 'X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output' always;
280+
add_header 'Access-Control-Expose-Headers' 'Content-Range, X-Chunked-Output, X-Stream-Output' always;
281+
282+
location / {
283+
proxy_set_header Host \$host;
284+
# The gateway upstream is defined in the gateway.conf.
285+
proxy_pass http://gateway;
286+
proxy_pass_header Server;
287+
proxy_read_timeout 60s;
288+
}
289+
290+
location ~ "^/(ipfs|ipns)(/|$)" {
291+
proxy_set_header Host "";
292+
proxy_set_header X-Ipfs-Gateway-Prefix "";
293+
proxy_pass http://gateway;
294+
}
295+
}
296+
297+
server {
298+
server_name *.i.ipfs.io;
299+
300+
listen 443 ssl;
301+
listen [::]:443 ssl;
302+
ssl_certificate /etc/nginx/certs/i.ipfs.io.crt;
303+
ssl_certificate_key /etc/nginx/certs/i.ipfs.io.key;
304+
ssl_dhparam /etc/nginx/certs/i.ipfs.io.dhparam.pem;
305+
ssl_trusted_certificate /etc/nginx/certs/i.ipfs.io.trustchain.crt;
306+
307+
# HSTS (ngx_http_headers_module is required)
308+
# 31536000 seconds = 12 months, as advised by hstspreload.org
309+
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
310+
311+
add_header 'Access-Control-Allow-Origin' '*' always;
312+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
313+
add_header 'Access-Control-Allow-Headers' 'X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output' always;
314+
add_header 'Access-Control-Expose-Headers' 'Content-Range, X-Chunked-Output, X-Stream-Output' always;
315+
316+
location / {
317+
proxy_set_header Host "";
318+
# The gateway upstream is defined in the gateway.conf.
319+
proxy_pass http://gateway;
320+
proxy_pass_header Server;
321+
proxy_read_timeout 60s;
322+
}
323+
}
324+
150325
server {
151326
server_name *.ipfs.dweb.link *.ipns.dweb.link;
152327
access_log /var/log/nginx/access.log mtail;
@@ -156,6 +331,11 @@ server {
156331

157332
include conf.d/gateway/denylist.conf;
158333

334+
add_header 'Access-Control-Allow-Origin' '*' always;
335+
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
336+
add_header 'Access-Control-Allow-Headers' 'X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output' always;
337+
add_header 'Access-Control-Expose-Headers' 'Content-Range, X-Chunked-Output, X-Stream-Output' always;
338+
159339
proxy_pass_header Server;
160340
proxy_read_timeout 1800s;
161341

‎ipfs/pages/nginx.conf.tpl

+1-103
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
server {
2-
server_name *.i.ipfs.io beta.docs.ipfs.io filecoin.io orbit.chat ipld.io libp2p.io multiformats.io zcash.dag.ipfs.io wikipedia-on-ipfs.org en.wikipedia-on-ipfs.org tr.wikipedia-on-ipfs.org simple.wikipedia-on-ipfs.org ar.wikipedia-on-ipfs.org ku.wikipedia-on-ipfs.org datatogether.org saftproject.com www.saftproject.com saft-project.com www.saft-project.com saft-project.org www.saft-project.org peerpad.net flipchart.peerpad.net;
2+
server_name beta.docs.ipfs.io filecoin.io orbit.chat ipld.io libp2p.io multiformats.io zcash.dag.ipfs.io wikipedia-on-ipfs.org en.wikipedia-on-ipfs.org tr.wikipedia-on-ipfs.org simple.wikipedia-on-ipfs.org ar.wikipedia-on-ipfs.org ku.wikipedia-on-ipfs.org datatogether.org saftproject.com www.saftproject.com saft-project.com www.saft-project.com saft-project.org www.saft-project.org peerpad.net flipchart.peerpad.net;
33
access_log /var/log/nginx/access.log mtail;
44
55
listen 80;
@@ -18,30 +18,6 @@ server {
1818
return 301 https://protocol.ai\$request_uri;
1919
}
2020

21-
server {
22-
server_name *.i.ipfs.io;
23-
access_log /var/log/nginx/access.log mtail;
24-
25-
listen 443 ssl;
26-
listen [::]:443 ssl;
27-
ssl_certificate /etc/nginx/certs/i.ipfs.io.crt;
28-
ssl_certificate_key /etc/nginx/certs/i.ipfs.io.key;
29-
ssl_dhparam /etc/nginx/certs/i.ipfs.io.dhparam.pem;
30-
ssl_trusted_certificate /etc/nginx/certs/i.ipfs.io.trustchain.crt;
31-
32-
# HSTS (ngx_http_headers_module is required)
33-
# 31536000 seconds = 12 months, as advised by hstspreload.org
34-
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
35-
36-
location / {
37-
proxy_set_header Host "";
38-
# The gateway upstream is defined in the ipfs/gateway unit.
39-
proxy_pass http://gateway;
40-
proxy_pass_header Server;
41-
proxy_read_timeout 60s;
42-
}
43-
}
44-
4521
server {
4622
server_name beta.docs.ipfs.io;
4723
access_log /var/log/nginx/access.log mtail;
@@ -114,84 +90,6 @@ server {
11490
}
11591
}
11692

117-
upstream ws_bootstrap {
118-
server 127.0.0.1:8081;
119-
}
120-
121-
server {
122-
server_name $(var pages_bootstrap_hostname).bootstrap.libp2p.io;
123-
access_log /var/log/nginx/access.log mtail;
124-
125-
listen 443 ssl;
126-
listen [::]:443 ssl;
127-
ssl_certificate /etc/nginx/certs/bootstrap.libp2p.io.crt;
128-
ssl_certificate_key /etc/nginx/certs/bootstrap.libp2p.io.key;
129-
ssl_dhparam /etc/nginx/certs/bootstrap.libp2p.io.dhparam.pem;
130-
ssl_trusted_certificate /etc/nginx/certs/bootstrap.libp2p.io.trustchain.crt;
131-
132-
# HSTS (ngx_http_headers_module is required)
133-
# 31536000 seconds = 12 months, as advised by hstspreload.org
134-
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
135-
136-
location / {
137-
proxy_set_header Host $(var pages_bootstrap_hostname).bootstrap.libp2p.io:443;
138-
proxy_set_header Upgrade \$http_upgrade;
139-
proxy_set_header Connection \$http_connection;
140-
proxy_set_header Sec-WebSocket-Key \$http_sec_websocket_key;
141-
proxy_set_header Sec-WebSocket-Extensions \$http_sec_websocket_extensions;
142-
proxy_set_header Sec-WebSocket-Version \$http_sec_websocket_version;
143-
proxy_pass http://ws_bootstrap;
144-
proxy_pass_header Server;
145-
proxy_read_timeout 60s;
146-
}
147-
}
148-
149-
server {
150-
server_name *.preload.ipfs.io;
151-
access_log /var/log/nginx/access.log mtail;
152-
153-
listen 443 ssl;
154-
listen [::]:443 ssl;
155-
ssl_certificate /etc/nginx/certs/preload.ipfs.io.crt;
156-
ssl_certificate_key /etc/nginx/certs/preload.ipfs.io.key;
157-
ssl_dhparam /etc/nginx/certs/preload.ipfs.io.dhparam.pem;
158-
ssl_trusted_certificate /etc/nginx/certs/preload.ipfs.io.trustchain.crt;
159-
160-
# HSTS (ngx_http_headers_module is required)
161-
# 31536000 seconds = 12 months, as advised by hstspreload.org
162-
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
163-
164-
location /ipfs {
165-
proxy_set_header Host \$host:443;
166-
proxy_set_header X-Ipfs-Gateway-Prefix "";
167-
proxy_pass http://gateway;
168-
}
169-
170-
location /ipns {
171-
proxy_set_header Host \$host:443;
172-
proxy_set_header X-Ipfs-Gateway-Prefix "";
173-
proxy_pass http://gateway;
174-
}
175-
176-
location /api {
177-
proxy_set_header Host \$host:443;
178-
proxy_set_header X-Ipfs-Gateway-Prefix "";
179-
proxy_pass http://gateway;
180-
}
181-
182-
location / {
183-
proxy_set_header Host \$host:80;
184-
proxy_set_header Upgrade \$http_upgrade;
185-
proxy_set_header Connection \$http_connection;
186-
proxy_set_header Sec-WebSocket-Key \$http_sec_websocket_key;
187-
proxy_set_header Sec-WebSocket-Extensions \$http_sec_websocket_extensions;
188-
proxy_set_header Sec-WebSocket-Version \$http_sec_websocket_version;
189-
proxy_pass http://ws_bootstrap;
190-
proxy_pass_header Server;
191-
proxy_read_timeout 60s;
192-
}
193-
}
194-
19593
server {
19694
server_name ipld.io;
19795
access_log /var/log/nginx/access.log mtail;

‎nginx/nginx.conf

+2
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,8 @@ http {
6464
proxy_buffering off;
6565
proxy_buffer_size 4k;
6666
proxy_temp_path /tmp/nginx;
67+
proxy_hide_header Access-Control-Allow-Headers;
68+
proxy_hide_header Access-Control-Expose-Headers;
6769

6870
include /etc/nginx/conf.d/*.conf;
6971
}

0 commit comments

Comments
 (0)