gesis.mybinder.org build redirect: allow all origins if request as no…

… origin, otherwise allow only value of request origin (jupyterhub/mybinder.org-deploy#1344)
gesiscss · Feb 20, 2020 · dcc7960 · dcc7960
1 parent b7017d7
commit dcc7960
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/load_balancer/sites-available/gesis_mybinder b/load_balancer/sites-available/gesis_mybinder
@@ -1,3 +1,8 @@
+map $http_origin $allowed_origin {
+    default $http_origin;
+    "" "*";
+}
+
 # HTTP server to redirect gesis.mybinder.org 80 traffic to SSL/HTTPS
 server {
     listen 80;
@@ -42,7 +47,7 @@ server {
         limit_except GET {
             deny  all;
         }
-        add_header Access-Control-Allow-Origin $http_origin;
+        add_header Access-Control-Allow-Origin $allowed_origin;
         add_header Vary Origin;
         add_header "Access-Control-Allow-Credentials"  "true";
         add_header 'Access-Control-Allow-Headers' 'cache-control';