Self-hosted setup limiting CORS origin breaks Ente web

[woodedjurassicpark]

Issue

I have a single server setup with an nginx reverse proxy. I am using a Garage S3 server on the same server. I can successfully use Ente web if my S3 Allow-Origin header is set to '*'. However, if I set the Allow-Origin to anything else, then XHR GET requests break when using using Ente web from any browser. The Allow-Origin header gets set to null when GET requests are sent to S3. Therefore, images don't load but uploads work.

There is some discussion on Discord here https://discord.com/channels/948937918347608085/1455243698794139901

Troubleshooting

I setup a custom log to see that the origin is being mapped correctly, when the browsers request origin is not null.

Configuration

io.example.net (NGINX - Garage - S3 )

# Map allowed CORS origins
map $http_origin $cors_origin {
    default "";
    "https://photos.example.net" $http_origin;
    "https://api.example.net" $http_origin;
    "https://albums.example.net" $http_origin;
    "http://127.0.0.1:3000" $http_origin;
}

log_format custom '$cors_origin - $http_origin';

server {

    server_name io.example.net;

    client_max_body_size 0;

    access_log /var/log/nginx/io.access.log;
    access_log /var/log/nginx/io.access.custom.log custom;
    error_log /var/log/nginx/io.error.log;

    location / {
        proxy_pass http://127.0.0.1:3900;
        include proxy_params;

        proxy_max_temp_file_size 0;

        # Enable CORS
        add_header 'Access-Control-Allow-Origin' $cors_origin;
        add_header 'Access-Control-Allow-Headers' '*';
        add_header 'Access-Control-Allow-Methods' 'GET, HEAD, POST, PUT, DELETE';
        add_header 'Access-Control-Max-Age' '3000';
        add_header 'Access-Control-Expose-Headers' 'Etag';

        # Handle preflight OPTIONS request
        if ($request_method = OPTIONS) {
            add_header 'Access-Control-Allow-Origin' $cors_origin;
            add_header 'Access-Control-Allow-Headers' '*';
            add_header 'Access-Control-Allow-Methods' 'GET, HEAD, POST, PUT, DELETE';
            add_header 'Access-Control-Max-Age' '3000';
            return 204;  # No content response
        }
    }

    listen [::]:20006 ssl; # managed by Certbot
    listen 20006 ssl; # managed by Certbot
    http2 on;
    ssl_certificate /etc/letsencrypt/live/io.example.net/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/io.example.net/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}