Skip to content

Commit 86beeb4

Browse files
sych74sych74
authored
Merge pull request #1 from vlobzakov/master
CORS-CDN issue update added
2 parents 755746f + 881b9e0 commit 86beeb4

File tree

3 files changed

+205
-0
lines changed

3 files changed

+205
-0
lines changed

‎CORS-CDN/README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
## CORS issue fixing
2+
3+
Installing the **Edgeport - Premium CDN Add-On** on Magento 2 application, you will be experiencing [**Cross-Origin Resource Sharing (CORS)**](https://en.wikipedia.org/wiki/Cross-origin_resource_sharing) issue which is invoked when a web application executes a cross-origin HTTP request when it requests a resource that has a different origin (domain, protocol, and port) than its own origin.
4+
5+
There are several ways how to overcome this issue. One of them we describe here.
6+
7+
1. Upload **cors.conf** file from repository directory **CORS-CDN** to **/etc/nginx/** directory.
8+
9+
2. Open **cors.conf** , find line #5 and replace **magentohostname** with your environment hostname and **magentocdnhostname** with magento CDN hostname obtained upon Add-On installation.
10+
11+
For example: **if ($http_origin ~* 'https?://(localhost|magento\\.jelastic\\.com|magento\\.cdn\\.edgeport\\.net)')**
12+
13+
3. Replace **/etc/nginx/conf.d/site-default.conf** with **site-default.conf** from repository directory **CORS-CDN**.
14+
15+
4. The changes added as lines **67, 79** and **104** to **site-default.conf**.

‎CORS-CDN/cors.conf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
set $cors 'true';
2+
3+
#### Replace "magentohostname" with Jelastic platform hostname or customdomain and "magentocdnhostname" with magento CDN hostname obtained from add-on or CDN custom domain you've bound to the environment.
4+
#### For example: if ($http_origin ~* 'https?://(localhost|magento\.jelastic\.com|magento\.cdn\.edgeport\.net)') {
5+
if ($http_origin ~* 'https?://(localhost|magentohostname|magentocdnhostname)') {
6+
set $cors 'true';
7+
}
8+
9+
#### always is required to add headers even if response's status is 4xx or 5xx
10+
if ($cors = 'true') {
11+
add_header 'Access-Control-Allow-Origin' '*' always;
12+
add_header 'Access-Control-Allow-Credentials' 'true' always;
13+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
14+
add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With' always;
15+
# required to be able to read Authorization header in frontend
16+
add_header 'Access-Control-Expose-Headers' 'Authorization' always;
17+
}
18+
19+
#### 2 if are required, nginx treats each if block as a different context
20+
if ($request_method = 'OPTIONS') {
21+
add_header 'Access-Control-Allow-Origin' '*';
22+
add_header 'Access-Control-Allow-Credentials' 'true';
23+
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
24+
add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With';
25+
26+
return 204;
27+
}

‎CORS-CDN/site-default.conf‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
server {
2+
listen 80;
3+
server_name localhost;
4+
index index.php;
5+
autoindex off;
6+
charset off;
7+
8+
set $MAGE_ROOT /var/www/webroot/ROOT;
9+
set $MAGE_MODE default;
10+
root $MAGE_ROOT/pub;
11+
12+
location ~* ^/setup($|/) {
13+
root $MAGE_ROOT;
14+
location ~ ^/setup/index.php {
15+
fastcgi_pass unix:/var/run/php-fpm.socket;
16+
fastcgi_index index.php;
17+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
18+
include fastcgi_params;
19+
}
20+
21+
location ~ ^/setup/(?!pub/). {
22+
deny all;
23+
}
24+
25+
location ~ ^/setup/pub/ {
26+
add_header X-Frame-Options "SAMEORIGIN";
27+
}
28+
}
29+
30+
# PHP entry point for update application
31+
location ~* ^/update($|/) {
32+
root $MAGE_ROOT;
33+
34+
location ~ ^/update/index.php {
35+
fastcgi_split_path_info ^(/update/index.php)(/.+)$;
36+
fastcgi_pass unix:/var/run/php-fpm.socket;
37+
fastcgi_index index.php;
38+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
39+
fastcgi_param PATH_INFO $fastcgi_path_info;
40+
include fastcgi_params;
41+
}
42+
43+
# Deny everything but index.php
44+
location ~ ^/update/(?!pub/). {
45+
deny all;
46+
}
47+
48+
location ~ ^/update/pub/ {
49+
add_header X-Frame-Options "SAMEORIGIN";
50+
}
51+
}
52+
53+
location / {
54+
try_files $uri $uri/ /index.php?$args;
55+
}
56+
57+
location /pub/ {
58+
location ~ ^/pub/media/(downloadable|customer|import|theme_customization/.*\.xml) {
59+
deny all;
60+
}
61+
alias $MAGE_ROOT/pub/;
62+
add_header X-Frame-Options "SAMEORIGIN";
63+
}
64+
65+
location /static/ {
66+
# Add the following line to enable CORS
67+
include /etc/nginx/cors.conf;
68+
# Uncomment the following line in production mode
69+
# expires max;
70+
71+
# Remove signature of the static files that is used to overcome the browser cache
72+
location ~ ^/static/version {
73+
rewrite ^/static/(version\d*/)?(.*)$ /static/$2 last;
74+
}
75+
76+
location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
77+
add_header Cache-Control "public";
78+
# Add the following line to add an "Access-Control-Allow-Origin" response header to define that the response can be shared with requesting code from any origin.
79+
add_header Access-Control-Allow-Origin "*";
80+
add_header X-Frame-Options "SAMEORIGIN";
81+
expires +1y;
82+
83+
if (!-f $request_filename) {
84+
rewrite ^/static/(version\d*/)?(.*)$ /static.php?resource=$2 last;
85+
}
86+
}
87+
location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
88+
add_header Cache-Control "no-store";
89+
add_header X-Frame-Options "SAMEORIGIN";
90+
expires off;
91+
92+
if (!-f $request_filename) {
93+
rewrite ^/static/(version\d*/)?(.*)$ /static.php?resource=$2 last;
94+
}
95+
}
96+
if (!-f $request_filename) {
97+
rewrite ^/static/(version\d*/)?(.*)$ /static.php?resource=$2 last;
98+
}
99+
add_header X-Frame-Options "SAMEORIGIN";
100+
}
101+
102+
location /media/ {
103+
# Add the following line to enable CORS
104+
include /etc/nginx/cors.conf;
105+
try_files $uri $uri/ /get.php?$args;
106+
107+
location ~ ^/media/theme_customization/.*\.xml {
108+
deny all;
109+
}
110+
111+
location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
112+
add_header Cache-Control "public";
113+
add_header X-Frame-Options "SAMEORIGIN";
114+
expires +1y;
115+
try_files $uri $uri/ /get.php?$args;
116+
}
117+
location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
118+
add_header Cache-Control "no-store";
119+
add_header X-Frame-Options "SAMEORIGIN";
120+
expires off;
121+
try_files $uri $uri/ /get.php?$args;
122+
}
123+
add_header X-Frame-Options "SAMEORIGIN";
124+
}
125+
126+
location /media/customer/ {
127+
deny all;
128+
}
129+
130+
location /media/downloadable/ {
131+
deny all;
132+
}
133+
134+
location /media/import/ {
135+
deny all;
136+
}
137+
138+
# PHP entry point for main application
139+
location ~ (index|get|static|report|404|503)\.php$ {
140+
try_files $uri =404;
141+
fastcgi_pass unix:/var/run/php-fpm.socket;
142+
fastcgi_buffers 1024 4k;
143+
144+
fastcgi_read_timeout 600s;
145+
fastcgi_connect_timeout 600s;
146+
147+
fastcgi_index index.php;
148+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
149+
include fastcgi_params;
150+
}
151+
152+
# Banned locations (only reached if the earlier PHP entry point regexes don't match)
153+
location ~* (\.php$|\.htaccess$|\.git) {
154+
deny all;
155+
}
156+
157+
location = /health_check.php {
158+
allow all;
159+
}
160+
161+
}
162+
163+

0 commit comments

Comments
 (0)