How to comply with AMP CORS specification for content served from AWS S3 and Cloudfront












0















I am serving some static AMPHTML content using AWS S3 for object storage, and AWS Cloudfront as a CDN and SSL layer.



In order to access e.g. a JSON document from an <amp-list>, I need to ensure that this setup complies with AMP CORS Specification.



In general I have set up S3 CORs in the past using Bucket CORs configurations such as:



<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<MaxAgeSeconds>1800</MaxAgeSeconds>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>


But I don't see how I can make these kind of rules comply with the AMP CORs specification which requires "Access-Control-Allow-Origin" and "AMP-Access-Control-Allow-Source-Origin" to match the actual source rather than a wildcard. From their docs:




Although the W3 CORS spec allows the value of * to be returned in the
response, for improved security, you should:



If the Origin header is present, validate and echo the value of the
Origin header. If the Origin header isn't present, validate and echo
the value of the "__amp_source_origin".




I'm currently also looking up how S3 CORs configuration plays with Cloudfront. I've done something with that before, but not sure how it will affect the rules I'm trying to write now.



Thanks in advance!










share|improve this question























  • The page from the AMP docs that’s quoted in the question also contains sample code showing how to do exactly what you’re asking: ampproject.org/docs/fundamentals/…

    – sideshowbarker
    Nov 28 '18 at 22:28













  • The sample code shows how to do this with a general JS server, but to use S3 and Cloudfront I need to turn this logic into an S3 <CORSRule> and some kind of Cloudfront header whitelist. That's what I'm not sure how to do...

    – rjmurt
    Nov 28 '18 at 23:09
















0















I am serving some static AMPHTML content using AWS S3 for object storage, and AWS Cloudfront as a CDN and SSL layer.



In order to access e.g. a JSON document from an <amp-list>, I need to ensure that this setup complies with AMP CORS Specification.



In general I have set up S3 CORs in the past using Bucket CORs configurations such as:



<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<MaxAgeSeconds>1800</MaxAgeSeconds>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>


But I don't see how I can make these kind of rules comply with the AMP CORs specification which requires "Access-Control-Allow-Origin" and "AMP-Access-Control-Allow-Source-Origin" to match the actual source rather than a wildcard. From their docs:




Although the W3 CORS spec allows the value of * to be returned in the
response, for improved security, you should:



If the Origin header is present, validate and echo the value of the
Origin header. If the Origin header isn't present, validate and echo
the value of the "__amp_source_origin".




I'm currently also looking up how S3 CORs configuration plays with Cloudfront. I've done something with that before, but not sure how it will affect the rules I'm trying to write now.



Thanks in advance!










share|improve this question























  • The page from the AMP docs that’s quoted in the question also contains sample code showing how to do exactly what you’re asking: ampproject.org/docs/fundamentals/…

    – sideshowbarker
    Nov 28 '18 at 22:28













  • The sample code shows how to do this with a general JS server, but to use S3 and Cloudfront I need to turn this logic into an S3 <CORSRule> and some kind of Cloudfront header whitelist. That's what I'm not sure how to do...

    – rjmurt
    Nov 28 '18 at 23:09














0












0








0


0






I am serving some static AMPHTML content using AWS S3 for object storage, and AWS Cloudfront as a CDN and SSL layer.



In order to access e.g. a JSON document from an <amp-list>, I need to ensure that this setup complies with AMP CORS Specification.



In general I have set up S3 CORs in the past using Bucket CORs configurations such as:



<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<MaxAgeSeconds>1800</MaxAgeSeconds>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>


But I don't see how I can make these kind of rules comply with the AMP CORs specification which requires "Access-Control-Allow-Origin" and "AMP-Access-Control-Allow-Source-Origin" to match the actual source rather than a wildcard. From their docs:




Although the W3 CORS spec allows the value of * to be returned in the
response, for improved security, you should:



If the Origin header is present, validate and echo the value of the
Origin header. If the Origin header isn't present, validate and echo
the value of the "__amp_source_origin".




I'm currently also looking up how S3 CORs configuration plays with Cloudfront. I've done something with that before, but not sure how it will affect the rules I'm trying to write now.



Thanks in advance!










share|improve this question














I am serving some static AMPHTML content using AWS S3 for object storage, and AWS Cloudfront as a CDN and SSL layer.



In order to access e.g. a JSON document from an <amp-list>, I need to ensure that this setup complies with AMP CORS Specification.



In general I have set up S3 CORs in the past using Bucket CORs configurations such as:



<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<MaxAgeSeconds>1800</MaxAgeSeconds>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>


But I don't see how I can make these kind of rules comply with the AMP CORs specification which requires "Access-Control-Allow-Origin" and "AMP-Access-Control-Allow-Source-Origin" to match the actual source rather than a wildcard. From their docs:




Although the W3 CORS spec allows the value of * to be returned in the
response, for improved security, you should:



If the Origin header is present, validate and echo the value of the
Origin header. If the Origin header isn't present, validate and echo
the value of the "__amp_source_origin".




I'm currently also looking up how S3 CORs configuration plays with Cloudfront. I've done something with that before, but not sure how it will affect the rules I'm trying to write now.



Thanks in advance!







amazon-web-services amazon-s3 cors amazon-cloudfront amp-html






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Nov 28 '18 at 12:14









rjmurtrjmurt

475417




475417













  • The page from the AMP docs that’s quoted in the question also contains sample code showing how to do exactly what you’re asking: ampproject.org/docs/fundamentals/…

    – sideshowbarker
    Nov 28 '18 at 22:28













  • The sample code shows how to do this with a general JS server, but to use S3 and Cloudfront I need to turn this logic into an S3 <CORSRule> and some kind of Cloudfront header whitelist. That's what I'm not sure how to do...

    – rjmurt
    Nov 28 '18 at 23:09



















  • The page from the AMP docs that’s quoted in the question also contains sample code showing how to do exactly what you’re asking: ampproject.org/docs/fundamentals/…

    – sideshowbarker
    Nov 28 '18 at 22:28













  • The sample code shows how to do this with a general JS server, but to use S3 and Cloudfront I need to turn this logic into an S3 <CORSRule> and some kind of Cloudfront header whitelist. That's what I'm not sure how to do...

    – rjmurt
    Nov 28 '18 at 23:09

















The page from the AMP docs that’s quoted in the question also contains sample code showing how to do exactly what you’re asking: ampproject.org/docs/fundamentals/…

– sideshowbarker
Nov 28 '18 at 22:28







The page from the AMP docs that’s quoted in the question also contains sample code showing how to do exactly what you’re asking: ampproject.org/docs/fundamentals/…

– sideshowbarker
Nov 28 '18 at 22:28















The sample code shows how to do this with a general JS server, but to use S3 and Cloudfront I need to turn this logic into an S3 <CORSRule> and some kind of Cloudfront header whitelist. That's what I'm not sure how to do...

– rjmurt
Nov 28 '18 at 23:09





The sample code shows how to do this with a general JS server, but to use S3 and Cloudfront I need to turn this logic into an S3 <CORSRule> and some kind of Cloudfront header whitelist. That's what I'm not sure how to do...

– rjmurt
Nov 28 '18 at 23:09












0






active

oldest

votes











Your Answer






StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53519245%2fhow-to-comply-with-amp-cors-specification-for-content-served-from-aws-s3-and-clo%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























0






active

oldest

votes








0






active

oldest

votes









active

oldest

votes






active

oldest

votes
















draft saved

draft discarded




















































Thanks for contributing an answer to Stack Overflow!


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53519245%2fhow-to-comply-with-amp-cors-specification-for-content-served-from-aws-s3-and-clo%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

A CLEAN and SIMPLE way to add appendices to Table of Contents and bookmarks

Calculate evaluation metrics using cross_val_predict sklearn

Insert data from modal to MySQL (multiple modal on website)