From b35c77b8968230d2e2f583f288bc2929d5cb2758 Mon Sep 17 00:00:00 2001 From: Grant Slater Date: Thu, 3 Sep 2026 10:30:56 +0100 Subject: [PATCH] tile: Allow X-Requested-With header via CORS --- cookbooks/tile/templates/default/apache.erb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/cookbooks/tile/templates/default/apache.erb b/cookbooks/tile/templates/default/apache.erb index ddda8ac51..5f7715744 100644 --- a/cookbooks/tile/templates/default/apache.erb +++ b/cookbooks/tile/templates/default/apache.erb @@ -66,6 +66,8 @@ # Always set Access-Control-Allow-Origin so that simple CORS requests # will always work and can be cached Header always set Access-Control-Allow-Origin "*" "expr=-z resp('Access-Control-Allow-Origin')" + Header always set Access-Control-Allow-Methods "GET, HEAD, OPTIONS" "expr=-z resp('Access-Control-Allow-Methods')" + Header always set Access-Control-Allow-Headers "X-Requested-With" "expr=-z resp('Access-Control-Allow-Headers')" # Add diagnostics header to identify render server Header always set X-TileRender "<%= node.name %>" @@ -142,7 +144,9 @@ # Always set Access-Control-Allow-Origin so that simple CORS requests # will always work and can be cached - Header set Access-Control-Allow-Origin "*" + Header always set Access-Control-Allow-Origin "*" + Header always set Access-Control-Allow-Methods "GET, HEAD, OPTIONS" + Header always set Access-Control-Allow-Headers "X-Requested-With" # Add diagnostics header to identify render server Header set X-TileRender "<%= node.name %>" -- 2.47.3