issues with duplicate CORS headers

[iferencik]

Oddly enough I am having some CORS issues with titiler.
I have deployed titiler behind nginx at a specific prefix, and I am constantly getting CORS errors. I managed to tract down the problem to duplicated access-control-allow-origin: * header.

http --follow --verbose GET "https://undp.livedata.link/hrea/tiles/2/2/1.png?scale=1&TileMatrixSetId=WebMercatorQuad&url=https://undpngddlsgeohubdev01.blob.core.windows.net/testforgeohub/HREA_Algeria_2012_v1%2FAlgeria_rade9lnmu_2012.tif&url_params=c3Y9MjAyMC0xMC0wMiZzZT0yMDIyLTAyLTI2VDAzJTNBMTElM0EzOVomc3I9YiZzcD1yJnNpZz1GdjF1SW5PN1ZZeEszckp6dHNaMmMyek12V0VGam9TYlluS2MlMkJGelYxZnclM0Q=&bidx=1&unscale=false&resampling=nearest&rescale=0,1&colormap_name=inferno&return_mask=true" Access-Control-Request-Method:GET Access-Control-Request-Headers:X-Requested-With Origin:undep
GET /hrea/tiles/2/2/1.png?scale=1&TileMatrixSetId=WebMercatorQuad&url=https://undpngddlsgeohubdev01.blob.core.windows.net/testforgeohub/HREA_Algeria_2012_v1%2FAlgeria_rade9lnmu_2012.tif&url_params=c3Y9MjAyMC0xMC0wMiZzZT0yMDIyLTAyLTI2VDAzJTNBMTElM0EzOVomc3I9YiZzcD1yJnNpZz1GdjF1SW5PN1ZZeEszckp6dHNaMmMyek12V0VGam9TYlluS2MlMkJGelYxZnclM0Q=&bidx=1&unscale=false&resampling=nearest&rescale=0,1&colormap_name=inferno&return_mask=true HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Access-Control-Request-Headers: X-Requested-With
Access-Control-Request-Method: GET
Connection: keep-alive
Host: undp.livedata.link
Origin: undep
User-Agent: HTTPie/1.0.3



HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 3703
Content-Type: image/png
Date: Fri, 25 Feb 2022 03:14:43 GMT
Server: nginx/1.18.0 (Ubuntu)
access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: public, max-age=3600



+-----------------------------------------+
| NOTE: binary data not shown in terminal |
+-----------------------------------------+

Strangely, the preflight request is absolutely fine

http --follow --verbose OPTIONS "https://undp.livedata.link/hrea/tiles/2/2/1.png?scale=1&TileMatrixSetId=WebMercatorQuad&url=https://undpngddlsgeohubdev01.blob.core.windows.net/testforgeohub/HREA_Algeria_2012_v1%2FAlgeria_rade9lnmu_2012.tif&url_params=c3Y9MjAyMC0xMC0wMiZzZT0yMDIyLTAyLTI2VDAzJTNBMTElM0EzOVomc3I9YiZzcD1yJnNpZz1GdjF1SW5PN1ZZeEszckp6dHNaMmMyek12V0VGam9TYlluS2MlMkJGelYxZnclM0Q=&bidx=1&unscale=false&resampling=nearest&rescale=0,1&colormap_name=inferno&return_mask=true" Access-Control-Request-Method:GET Access-Control-Request-Headers:X-Requested-With Origin:undep
OPTIONS /hrea/tiles/2/2/1.png?scale=1&TileMatrixSetId=WebMercatorQuad&url=https://undpngddlsgeohubdev01.blob.core.windows.net/testforgeohub/HREA_Algeria_2012_v1%2FAlgeria_rade9lnmu_2012.tif&url_params=c3Y9MjAyMC0xMC0wMiZzZT0yMDIyLTAyLTI2VDAzJTNBMTElM0EzOVomc3I9YiZzcD1yJnNpZz1GdjF1SW5PN1ZZeEszckp6dHNaMmMyek12V0VGam9TYlluS2MlMkJGelYxZnclM0Q=&bidx=1&unscale=false&resampling=nearest&rescale=0,1&colormap_name=inferno&return_mask=true HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Access-Control-Request-Headers: X-Requested-With
Access-Control-Request-Method: GET
Connection: keep-alive
Content-Length: 0
Host: undp.livedata.link
Origin: undep
User-Agent: HTTPie/1.0.3



HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 22
Content-Type: text/plain; charset=utf-8
Date: Fri, 25 Feb 2022 03:27:27 GMT
Server: nginx/1.18.0 (Ubuntu)
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: undep
access-control-max-age: 600
content-encoding: gzip
vary: Origin, Accept-Encoding

OK

I tried to set the CORS through .env, directly in settings...but I am not able to track down why ad where is this header added twice.

I suspect this being and issue of starlette and possibly uvicorn because imho UVICORN SHOULD NOT allow duplicate headers to flow.

Any hints are more than welcome.

[vincentsarago]

this is indeed really weird and it has also been reported in encode/starlette#1309

[iferencik]

@vincentsarago , thanks for pointing out the starlette issue. The outcome however is ...

For this particular issue, the fix needed is to use exactly one of starlette or engine.io to handle CORS, as noted earlier.

I am a bit trapped here. On my local machine I have an older (0.4.2) titiler where CORS works...but can't parse complex expressions. On the dev server i have 0.5.0 that can parse the ; delimited expressions but has CORS issues :)))

I will try a new local folder based pipenv deployment and attempt to track and fix it somehow. Today I am supposed to present a demo of my svelte based maplibre frontend :)))

[vincentsarago]

really sorry @iferencik, maybe as a quick fix you could add a middleware to check the headers, as proposed in on Dec 28, 2021

[iferencik]

I am going to do just that probably. Thanks you your help.

[iferencik]

@vincentsarago ,I think i found the culprit. Looks like nginx proxy is adding Access-Control-Allow-Origin * header, at all times and for all urls. I have no knowledge of nginx but this is the snippet i found in the config.

server {
    server_name _; # managed by Certbot
    add_header Access-Control-Allow-Origin *;

The server is managed by a colleague of mine :))
So , most probably this is the cause of the issue. I will get back to you once i clarify and test it

Thank you again for your timely replies.

[vincentsarago]

🥳