Closed
Description
Request:
OPTIONS /api/cookbook/recipe/0068-newspaper/newspaper_issue_1-manifest.json HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Host: iiif.io
Origin: some-domain.tld
User-Agent: HTTPie/3.2.1
Response:
HTTP/1.1 403 Forbidden
Connection: keep-alive
Content-Length: 398
Date: Thu, 05 Oct 2023 22:31:17 GMT
Server: nginx/1.18.0
Via: 1.1 03d509e8374e9f42668961b5e0201348.cloudfront.net (CloudFront)
X-Amz-Cf-Id: NUvsdzztedC0zcUTuVv5uNoluZTBB5gsp6a8eSmoAKUrrA2HOZFTTQ==
X-Amz-Cf-Pop: FRA2-C2
X-Cache: Error from cloudfront
<html>
<head><title>403 Forbidden</title></head>
<body>
<h1>403 Forbidden</h1>
<ul>
<li>Code: AccessForbidden</li>
<li>Message: CORSResponse: CORS is not enabled for this bucket.</li>
<li>Method: OPTIONS</li>
<li>ResourceType: BUCKET</li>
<li>RequestId: YT8PSYTYEVHJXSFG</li>
<li>HostId: VF8G8U3d1hLH/aQnrrYIukklJwygjdsPfeDhgZn4XCD0tWLI+nkB3KbBhZHS91nlig+0mWNOxzc=</li>
</ul>
<hr/>
</body>
</html>
Given how important CORS is for IIIF, it would probably be wise to properly enable/implement it for cookbook resources and not only set the Access-Control-Allow-Origin header to *.
Background:
This error happens when making Content-Negotiation aware GET requests to resources, i.e. with an Accept header value that specifies the full JSON-LD MIME types for IIIF (see https://github.com/ProjectMirador/mirador/pull/3770/files#diff-166256fe28a89c78ada7b08488a3233671fc0511fd39d323c5cfc9433026e2a1R108-R112). These requests trigger a preflight OPTIONS request due to certain characters in the Accept header (more gnarly details in this comment: ProjectMirador/mirador#3770 (comment)).
Metadata
Metadata
Assignees
Labels
No labels