How to comply with AMP CORS specification for content served from AWS S3 and Cloudfront
I am serving some static AMPHTML content using AWS S3 for object storage, and AWS Cloudfront as a CDN and SSL layer.
In order to access e.g. a JSON document from an <amp-list>, I need to ensure that this setup complies with AMP CORS Specification.
In general I have set up S3 CORs in the past using Bucket CORs configurations such as:
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<MaxAgeSeconds>1800</MaxAgeSeconds>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>
But I don't see how I can make these kind of rules comply with the AMP CORs specification which requires "Access-Control-Allow-Origin" and "AMP-Access-Control-Allow-Source-Origin" to match the actual source rather than a wildcard. From their docs:
Although the W3 CORS spec allows the value of * to be returned in the
response, for improved security, you should:
If the Origin header is present, validate and echo the value of the
Origin header. If the Origin header isn't present, validate and echo
the value of the "__amp_source_origin".
I'm currently also looking up how S3 CORs configuration plays with Cloudfront. I've done something with that before, but not sure how it will affect the rules I'm trying to write now.
Thanks in advance!
amazon-web-services amazon-s3 cors amazon-cloudfront amp-html
asked Nov 28 '18 at 12:14
rjmurtrjmurt
475417
add a comment |
I am serving some static AMPHTML content using AWS S3 for object storage, and AWS Cloudfront as a CDN and SSL layer.
In order to access e.g. a JSON document from an <amp-list>, I need to ensure that this setup complies with AMP CORS Specification.
In general I have set up S3 CORs in the past using Bucket CORs configurations such as:
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<MaxAgeSeconds>1800</MaxAgeSeconds>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>
But I don't see how I can make these kind of rules comply with the AMP CORs specification which requires "Access-Control-Allow-Origin" and "AMP-Access-Control-Allow-Source-Origin" to match the actual source rather than a wildcard. From their docs:
Although the W3 CORS spec allows the value of * to be returned in the
response, for improved security, you should:
If the Origin header is present, validate and echo the value of the
Origin header. If the Origin header isn't present, validate and echo
the value of the "__amp_source_origin".
I'm currently also looking up how S3 CORs configuration plays with Cloudfront. I've done something with that before, but not sure how it will affect the rules I'm trying to write now.
Thanks in advance!
amazon-web-services amazon-s3 cors amazon-cloudfront amp-html
asked Nov 28 '18 at 12:14
rjmurtrjmurt
475417
The page from the AMP docs that’s quoted in the question also contains sample code showing how to do exactly what you’re asking: ampproject.org/docs/fundamentals/…
– sideshowbarker
Nov 28 '18 at 22:28
The sample code shows how to do this with a general JS server, but to use S3 and Cloudfront I need to turn this logic into an S3<CORSRule>and some kind of Cloudfront header whitelist. That's what I'm not sure how to do...
– rjmurt
Nov 28 '18 at 23:09
add a comment |
I am serving some static AMPHTML content using AWS S3 for object storage, and AWS Cloudfront as a CDN and SSL layer.
In order to access e.g. a JSON document from an <amp-list>, I need to ensure that this setup complies with AMP CORS Specification.
In general I have set up S3 CORs in the past using Bucket CORs configurations such as:
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<MaxAgeSeconds>1800</MaxAgeSeconds>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>
But I don't see how I can make these kind of rules comply with the AMP CORs specification which requires "Access-Control-Allow-Origin" and "AMP-Access-Control-Allow-Source-Origin" to match the actual source rather than a wildcard. From their docs:
Although the W3 CORS spec allows the value of * to be returned in the
response, for improved security, you should:
If the Origin header is present, validate and echo the value of the
Origin header. If the Origin header isn't present, validate and echo
the value of the "__amp_source_origin".
I'm currently also looking up how S3 CORs configuration plays with Cloudfront. I've done something with that before, but not sure how it will affect the rules I'm trying to write now.
Thanks in advance!
amazon-web-services amazon-s3 cors amazon-cloudfront amp-html
asked Nov 28 '18 at 12:14
rjmurtrjmurt
475417
I am serving some static AMPHTML content using AWS S3 for object storage, and AWS Cloudfront as a CDN and SSL layer.
In order to access e.g. a JSON document from an <amp-list>, I need to ensure that this setup complies with AMP CORS Specification.
In general I have set up S3 CORs in the past using Bucket CORs configurations such as:
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<MaxAgeSeconds>1800</MaxAgeSeconds>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>
But I don't see how I can make these kind of rules comply with the AMP CORs specification which requires "Access-Control-Allow-Origin" and "AMP-Access-Control-Allow-Source-Origin" to match the actual source rather than a wildcard. From their docs:
Although the W3 CORS spec allows the value of * to be returned in the
response, for improved security, you should:
If the Origin header is present, validate and echo the value of the
Origin header. If the Origin header isn't present, validate and echo
the value of the "__amp_source_origin".
I'm currently also looking up how S3 CORs configuration plays with Cloudfront. I've done something with that before, but not sure how it will affect the rules I'm trying to write now.
Thanks in advance!
amazon-web-services amazon-s3 cors amazon-cloudfront amp-html
amazon-web-services amazon-s3 cors amazon-cloudfront amp-html
asked Nov 28 '18 at 12:14
rjmurtrjmurt
475417
asked Nov 28 '18 at 12:14
rjmurtrjmurt
475417
asked Nov 28 '18 at 12:14
rjmurtrjmurt
475417
asked Nov 28 '18 at 12:14
rjmurtrjmurt
475417
asked Nov 28 '18 at 12:14
rjmurtrjmurt
475417
475417
The page from the AMP docs that’s quoted in the question also contains sample code showing how to do exactly what you’re asking: ampproject.org/docs/fundamentals/…
– sideshowbarker
Nov 28 '18 at 22:28
The sample code shows how to do this with a general JS server, but to use S3 and Cloudfront I need to turn this logic into an S3<CORSRule>and some kind of Cloudfront header whitelist. That's what I'm not sure how to do...
– rjmurt
Nov 28 '18 at 23:09
add a comment |
The page from the AMP docs that’s quoted in the question also contains sample code showing how to do exactly what you’re asking: ampproject.org/docs/fundamentals/…
– sideshowbarker
Nov 28 '18 at 22:28
The sample code shows how to do this with a general JS server, but to use S3 and Cloudfront I need to turn this logic into an S3<CORSRule>and some kind of Cloudfront header whitelist. That's what I'm not sure how to do...
– rjmurt
Nov 28 '18 at 23:09
The page from the AMP docs that’s quoted in the question also contains sample code showing how to do exactly what you’re asking: ampproject.org/docs/fundamentals/…
– sideshowbarker
Nov 28 '18 at 22:28
The page from the AMP docs that’s quoted in the question also contains sample code showing how to do exactly what you’re asking: ampproject.org/docs/fundamentals/…
– sideshowbarker
Nov 28 '18 at 22:28
The sample code shows how to do this with a general JS server, but to use S3 and Cloudfront I need to turn this logic into an S3
<CORSRule> and some kind of Cloudfront header whitelist. That's what I'm not sure how to do...– rjmurt
Nov 28 '18 at 23:09
The sample code shows how to do this with a general JS server, but to use S3 and Cloudfront I need to turn this logic into an S3
<CORSRule> and some kind of Cloudfront header whitelist. That's what I'm not sure how to do...– rjmurt
Nov 28 '18 at 23:09
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53519245%2fhow-to-comply-with-amp-cors-specification-for-content-served-from-aws-s3-and-clo%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53519245%2fhow-to-comply-with-amp-cors-specification-for-content-served-from-aws-s3-and-clo%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
The page from the AMP docs that’s quoted in the question also contains sample code showing how to do exactly what you’re asking: ampproject.org/docs/fundamentals/…
– sideshowbarker
Nov 28 '18 at 22:28
The sample code shows how to do this with a general JS server, but to use S3 and Cloudfront I need to turn this logic into an S3
<CORSRule>and some kind of Cloudfront header whitelist. That's what I'm not sure how to do...– rjmurt
Nov 28 '18 at 23:09