feature: add CORS_ALLOW_PRIVATE_NETWORK_ACCESS env var

Dockerfile.buildkit.plus

@@ -12,6 +12,7 @@ ENV PROXY_CACHE_VALID_OK "1h"
 ENV PROXY_CACHE_VALID_NOTFOUND "1m"
 ENV PROXY_CACHE_VALID_FORBIDDEN "30s"
 ENV CORS_ENABLED 0
+ENV CORS_ALLOW_PRIVATE_NETWORK_ACCESS ""
 ENV DIRECTORY_LISTING_PATH_PREFIX ""
 ENV STRIP_LEADING_DIRECTORY_PATH ""
 ENV PREFIX_LEADING_DIRECTORY_PATH ""

Dockerfile.oss

@@ -11,6 +11,7 @@ ENV PROXY_CACHE_VALID_OK "1h"
 ENV PROXY_CACHE_VALID_NOTFOUND "1m"
 ENV PROXY_CACHE_VALID_FORBIDDEN "30s"
 ENV CORS_ENABLED 0
+ENV CORS_ALLOW_PRIVATE_NETWORK_ACCESS ""
 ENV DIRECTORY_LISTING_PATH_PREFIX ""
 ENV STRIP_LEADING_DIRECTORY_PATH ""
 ENV PREFIX_LEADING_DIRECTORY_PATH ""

Dockerfile.plus

@@ -12,6 +12,7 @@ ENV PROXY_CACHE_VALID_OK "1h"
 ENV PROXY_CACHE_VALID_NOTFOUND "1m"
 ENV PROXY_CACHE_VALID_FORBIDDEN "30s"
 ENV CORS_ENABLED 0
+ENV CORS_ALLOW_PRIVATE_NETWORK_ACCESS ""
 ENV DIRECTORY_LISTING_PATH_PREFIX ""
 ENV STRIP_LEADING_DIRECTORY_PATH ""
 ENV PREFIX_LEADING_DIRECTORY_PATH ""

common/docker-entrypoint.d/00-check-for-required-env.sh

@@ -136,3 +136,4 @@ echo "Append slash for directory enabled: ${APPEND_SLASH_FOR_POSSIBLE_DIRECTORY}
 echo "Stripping the following headers from responses: x-amz-;${HEADER_PREFIXES_TO_STRIP}"
 echo "Allow the following headers from responses (these take precendence over the above): ${HEADER_PREFIXES_ALLOWED}"
 echo "CORS Enabled: ${CORS_ENABLED}"
+echo "CORS Allow Private Network Access: ${CORS_ALLOW_PRIVATE_NETWORK_ACCESS}"

common/docker-entrypoint.sh

@@ -68,6 +68,12 @@ if [ -z "${CORS_ALLOWED_ORIGIN+x}" ]; then
   export CORS_ALLOWED_ORIGIN="*"
 fi
 
+# See documentation for this feature. We do not parse this as a boolean
+# since "true" and "false" are the required values of the header this populates
+if [ "${CORS_ALLOW_PRIVATE_NETWORK_ACCESS}" != "true" ] && [ "${CORS_ALLOW_PRIVATE_NETWORK_ACCESS}" != "false" ]; then
+  export CORS_ALLOW_PRIVATE_NETWORK_ACCESS=""  
+fi
+
 # This is the primary logic to determine the s3 host used for the
 # upstream (the actual proxying action) as well as the `Host` header
 #

common/etc/nginx/templates/gateway/cors.conf.template

@@ -11,6 +11,12 @@ if ($request_cors = "OPTIONS_1") {
     # Tell client that this pre-flight info is valid for 20 days
     #
     add_header 'Access-Control-Max-Age' 1728000;
+    #
+    # Allow/deny Private Network Access CORS requests.
+    # https://developer.chrome.com/blog/private-network-access-preflight/
+    #
+    add_header 'Access-Control-Allow-Private-Network' '${CORS_ALLOW_PRIVATE_NETWORK_ACCESS}';
+
     add_header 'Content-Type' 'text/plain; charset=utf-8';
     add_header 'Content-Length' 0;
     return 204;

docs/getting_started.md

@@ -47,6 +47,7 @@ running as a Container or as a Systemd service.
 | `CORS_ALLOWED_ORIGIN`                 | No        |                              |           | Value to set to be returned from the CORS `Access-Control-Allow-Origin` header. This value is only used if CORS is enabled. (default: \*)                                                                                                                                                                                                                                                                                                                    |
 | `STRIP_LEADING_DIRECTORY_PATH`                 | No        |                              |           | Removes a portion of the path in the requested URL (if configured). Useful when deploying to an ALB under a folder (eg. www.mysite.com/somepath).                                                                                                                                                                                                                                                                                                                    |
 | `PREFIX_LEADING_DIRECTORY_PATH`                 | No        |                              |           | Prefix to prepend to all S3 object paths. Useful to serve only a subset of an S3 bucket. When used in combination with `STRIP_LEADING_DIRECTORY_PATH`, this allows the leading path to be replaced, rather than just removed.                                                                                                                                                                                                                                                                                                                    |
+| `CORS_ALLOW_PRIVATE_NETWORK_ACCESS`   | No        | `true`, `false`              |           | Flag that enables responding to the CORS OPTIONS pre-flight request header `Access-Control-Request-Private-Network` with the `Access-Control-Allow-Private-Network` header. If the value is "true", responds with "true", if "false" responds with "false". If the environment variable is blank/not set, does not respond with any header. This value is only used if CORS is enabled. See [Private Network Access: introducing preflights](https://developer.chrome.com/blog/private-network-access-preflight/) for more information about this header. |
 
 
 

standalone_ubuntu_oss_install.sh

@@ -97,6 +97,7 @@ echo "Proxy Caching Time for Valid Response: ${PROXY_CACHE_VALID_OK}"
 echo "Proxy Caching Time for Not Found Response: ${PROXY_CACHE_VALID_NOTFOUND}"
 echo "Proxy Caching Time for Forbidden Response: ${PROXY_CACHE_VALID_FORBIDDEN}"
 echo "CORS Enabled: ${CORS_ENABLED}"
+echo "CORS Allow Private Network Access: ${CORS_ALLOW_PRIVATE_NETWORK_ACCESS}"
 
 set -o nounset   # abort on unbound variable
 
@@ -230,12 +231,20 @@ fi
 
 set -o nounset   # abort on unbound variable
 
+
+# CORS related variable setup
 if [ -z "${CORS_ALLOWED_ORIGIN+x}" ]; then
 CORS_ALLOWED_ORIGIN="*"
 fi
 
+if [ "${CORS_ALLOW_PRIVATE_NETWORK_ACCESS:-}" != "true" ] && [ "${CORS_ALLOW_PRIVATE_NETWORK_ACCESS:-}" != "false" ]; then
+  CORS_ALLOW_PRIVATE_NETWORK_ACCESS=""
+fi
+
+
 cat >> "/etc/nginx/environment" << EOF
 CORS_ALLOWED_ORIGIN=${CORS_ALLOWED_ORIGIN}
+CORS_ALLOW_PRIVATE_NETWORK_ACCESS=${CORS_ALLOW_PRIVATE_NETWORK_ACCESS}
 EOF
 
 # Only include these env vars if we are not using a instance profile credential