From 672db0ffdbfdec5510c282e7eeb2adc30d535111 Mon Sep 17 00:00:00 2001
From: Grant Slater <git@firefishy.com>
Date: Fri, 22 Nov 2019 15:29:24 +0000
Subject: [PATCH] tilecache: restrict cache control headers to osm.org only

---
 .../templates/default/nginx_tile.conf.erb     | 21 +++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/cookbooks/tilecache/templates/default/nginx_tile.conf.erb b/cookbooks/tilecache/templates/default/nginx_tile.conf.erb
index 47d3bd372..0b77171e8 100644
--- a/cookbooks/tilecache/templates/default/nginx_tile.conf.erb
+++ b/cookbooks/tilecache/templates/default/nginx_tile.conf.erb
@@ -73,6 +73,11 @@ map $http_referer $denied_referer {
   'http://osm.org'                 1; # Faked
 }
 
+map $http_referer $osm_referer {
+  default                                 0;     # False
+  '~^https:\/\/www\.openstreetmap\.org\/' 'osm'; # True
+}
+
 # Limit Cache-Control header to only approved User-Agents
 map $http_user_agent $limit_http_cache_control {
   default '';                              # Unset Header
@@ -249,12 +254,20 @@ server {
         return 418;
       }
 
+      # Only allow cache purges if from OpenStreetMap referer
+      if ($osm_referer) {
+        # Allow cache purging headers only from select User-Agents (uses nginx Map)
+        proxy_set_header Cache-Control $limit_http_cache_control;
+        proxy_set_header Pragma $limit_http_pragma;
+      }
+      # nginx has no if else logic
+      if ($osm_referer != 'osm') {
+        proxy_set_header Cache-Control '';
+        proxy_set_header Pragma '';
+      }
+
       # Strip any ?query parameters from urls
       set $args '';
-
-      # Allow cache purging headers only from select User-Agents (uses nginx Map)
-      proxy_set_header Cache-Control $limit_http_cache_control;
-      proxy_set_header Pragma $limit_http_pragma;
     }
 <% end %>
 }
-- 
2.43.2