tilecache: restrict cache control headers to osm.org only

[chef.git] / cookbooks / tilecache / templates / default / nginx_tile.conf.erb

diff --git a/cookbooks/tilecache/templates/default/nginx_tile.conf.erb b/cookbooks/tilecache/templates/default/nginx_tile.conf.erb
index f53cb4ec440e9762d0a37bcd7e62f08a16e708f8..0b77171e84c7ed73001b51f01be3e1db326ed8ee 100644 (file)
--- a/cookbooks/tilecache/templates/default/nginx_tile.conf.erb
+++ b/cookbooks/tilecache/templates/default/nginx_tile.conf.erb
@@ -73,6 +73,11 @@ map $http_referer $denied_referer {
   'http://osm.org'                 1; # Faked
 }
 
+map $http_referer $osm_referer {
+  default                                 0;     # False
+  '~^https:\/\/www\.openstreetmap\.org\/' 'osm'; # True
+}
+
 # Limit Cache-Control header to only approved User-Agents
 map $http_user_agent $limit_http_cache_control {
   default '';                              # Unset Header
@@ -194,10 +199,11 @@ server {
       proxy_set_header Accept-Charset '';
       # Do not send origin, we allow all.
       proxy_set_header origin '';
-      # Do not pass invalid header to backend.
+      # Do not pass invalid headers to backend.
       proxy_set_header X-Forwarded-Host '';
       proxy_set_header X-Host '';
       proxy_set_header Authorization '';
+      proxy_set_header Proxy-Authorization '';
 
       # Drop partial requests
       proxy_set_header range '';
@@ -248,12 +254,20 @@ server {
         return 418;
       }
 
+      # Only allow cache purges if from OpenStreetMap referer
+      if ($osm_referer) {
+        # Allow cache purging headers only from select User-Agents (uses nginx Map)
+        proxy_set_header Cache-Control $limit_http_cache_control;
+        proxy_set_header Pragma $limit_http_pragma;
+      }
+      # nginx has no if else logic
+      if ($osm_referer != 'osm') {
+        proxy_set_header Cache-Control '';
+        proxy_set_header Pragma '';
+      }
+
       # Strip any ?query parameters from urls
       set $args '';
-
-      # Allow cache purging headers only from select User-Agents (uses nginx Map)
-      proxy_set_header Cache-Control $limit_http_cache_control;
-      proxy_set_header Pragma $limit_http_pragma;
     }
 <% end %>
 }