1218551 - delivery: set CORS headers on archive.m.o

Status: RESOLVED FIXED

(Cloud Services :: Operations: Miscellaneous, task)

Description

[Nick Thomas [:nthomas] (UTC+12)]

Bug 1216804 touches on this, but I can't find any requests which return
  Access-Control-Allow-Origin: *

eg old system:
$ curl -I http://ftp-origin-scl3.mozilla.org/pub/firefox/nightly/latest-trunk/firefox-44.0a1.en-US.win32.installer.exe
HTTP/1.1 200 OK
Server: Apache
X-Backend-Server: ftp1.dmz.scl3.mozilla.com
Cache-Control: max-age=3600
Content-Type: application/octet-stream
Date: Mon, 26 Oct 2015 20:24:48 GMT
Expires: Mon, 26 Oct 2015 21:24:48 GMT
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
ETag: "481f4fb-2ad0da8-5228a4575abc8"
Last-Modified: Tue, 20 Oct 2015 14:42:29 GMT
X-Cache-Info: caching
Content-Length: 44895656

new system:
$ curl -I http://archive.mozilla.org/pub/firefox/nightly/latest-trunk/firefox-44.0a1.en-US.win32.installer.exe
HTTP/1.1 200 OK
Content-Type: application/x-msdownload
Content-Length: 44918064
Connection: keep-alive
Date: Mon, 26 Oct 2015 20:30:28 GMT
x-amz-replication-status: COMPLETED
x-amz-version-id: U56w14rJAILAl0QNHF3LbbvFa0CT51F_
Last-Modified: Tue, 20 Oct 2015 00:44:48 GMT
ETag: "d7b0ebf91d73416d60d13644454ca8f6-6"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Miss from cloudfront
Via: 1.1 b1a2b9a72a104de32c891fbaab68827c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: NbJzzSvy0lLr83ZhpwlSFTFAu4B3oIt4Q3L6W34UXn7uD9XvLIYIGQ==

I think we had it enabled on all requests on the old system.

Comment 1

[Benjamin Smedberg]

We did, and this blocks the correct operation of http://bsmedberg.github.io/firefox-regression-range-finder/

Comment 2

[Jeremy Orem [:oremj]]

Cors headers are sent if the request sends an "Origin" header. Do I need to allow methods aside from GET?

✗ curl -v -H 'Origin: mozilla.com'  http://archive.mozilla.org/pub/firefox/nightly/latest-trunk/firefox-44.0a1.en-US.win32.installer.exe > /dev/null
* Connected to archive.mozilla.org (54.192.35.82) port 80 (#0)
> GET /pub/firefox/nightly/latest-trunk/firefox-44.0a1.en-US.win32.installer.exe HTTP/1.1
> Host: archive.mozilla.org
> User-Agent: curl/7.43.0
> Accept: */*
> Origin: mozilla.com
> 
< HTTP/1.1 200 OK
< Content-Type: application/x-msdownload
< Content-Length: 44918064
< Connection: keep-alive
< Date: Mon, 26 Oct 2015 22:57:42 GMT
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Methods: GET
< x-amz-replication-status: COMPLETED
< x-amz-version-id: U56w14rJAILAl0QNHF3LbbvFa0CT51F_
< Last-Modified: Tue, 20 Oct 2015 00:44:48 GMT
< ETag: "d7b0ebf91d73416d60d13644454ca8f6-6"
< Accept-Ranges: bytes
< Server: AmazonS3
< X-Cache: Miss from cloudfront
< Via: 1.1 0b6f8c22a8c9e6aba3c596b9382f5342.cloudfront.net (CloudFront)
< X-Amz-Cf-Id: fO3tPxZNwOH6o5Q1MkrWEL8fufaLSB0a1mLjKXBtwCl24dazeK-enA

Comment 3

[Jeremy Orem [:oremj]]

It looks like the problem is, it is requesting /pub/mozilla.org/firefox instead of /pub/firefox, getting a 302 and not following. Can you edit the code to remove /mozilla.org/ from the path?

Comment 4

[Benjamin Smedberg]

The request is being made by the browser, cross-origin. Even after changing to the new URL scheme it doesn't work. Here is the request being made by the client:

GET /pub/firefox/nightly/2015/10/2015-10-23-03-02-45-mozilla-central/ HTTP/1.1
Host: archive.mozilla.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost:8000/
Origin: http://localhost:8000
Connection: keep-alive

(or Origin: http://bsmedberg.github.io for the production site)

This isn't getting any Access-Control-Allow-Origin response headers. Perhaps because this is a directory listing?

I'd encourage to add Access-Control headers to the original http://ftp.mozilla.org redirect responses as well, although that's not necessary for me now that I've updated to the new URL scheme.

Comment 5

[Jeremy Orem [:oremj]]

You are right, objects are sending CORs headers, but the lister service is not. I'll push a fix today.

Comment 6

[Jeremy Orem [:oremj]]

The fix has been pushed. Thanks for the report.