Is `allow_cors=True` supposed to be add ACAO headers for visualisation?

[hexylena]

In lib/galaxy/datatypes/display_applications/configs/minerva/tabular.xml we set <param type="data" name="data" url="galaxy_${DATASET_HASH}.tsv" allow_cors="true" />

looking at lib/galaxy/webapps/galaxy/controllers/dataset.py L686 it looks like this is indeed used.
However it doesn't seem to function in a useful way for me.

Looking at the HEAD request, I'm not seeing a ACAO header,

$ curl --silent -H "Access-Control-Request-Method: GET" -H "Origin: https://covid19map.elixir-luxembourg.org" --head https://usegalaxy.org/display_application/f9cad7b01a47213579c3a2b970ae5cfc/minerva_tabular/covid19/3be62212b16e0268/data/galaxy_f9cad7b01a47213579c3a2b970ae5cfc.tsv | grep Access
$

versus EU who have a manual nginx exception for this visualisation (thanks y'all.)

$ curl --silent -H "Access-Control-Request-Method: GET" -H "Origin: https://covid19map.elixir-luxembourg.org" --head https://usegalaxy.eu/display_application/4838ba20a6d867656f60e7ad9f36a860/minerva_tabular/covid19/d3ca1b21b62e6581/data/galaxy_4838ba20a6d867656f60e7ad9f36a860.tsv | grep Access-Con
Access-Control-Allow-Origin: https://covid19map.elixir-luxembourg.org
Access-Control-Allow-Methods: GET
Access-Control-Expose-Headers: Content-Length,Content-Range
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range

[mvdbeek]

The fun thing is that avivator seems to request byte ranges that go beyond the content length, at least for small files:

I'll try with something bigger. That said Access-Control-Allow-Origin and Access-Control-Allow-Methods are in principle present, but we might be overriding them in the nginx config.

[mvdbeek]

ok, the trick is that we need to return the upstream response header.
I've done this temporarily on one of the upstream web servers:

curl --silent -H "Access-Control-Request-Methods: GET" -H "Origin: https://covid19map.elixir-luxembourg.org" --head https://galaxy-web-05.galaxyproject.org/display_application/f9cad7b01a47213579c3a2b970ae5cfc/minerva_tabular/covid19/3be62212b16e0268/data/galaxy_f9cad7b01a47213579c3a2b970ae5cfc.tsv | grep Access
Access-Control-Allow-Origin: https://covid19map.elixir-luxembourg.org
Access-Control-Allow-Methods: GET

we are not setting expose and allow, I suppose we'll need them ?

[mvdbeek]

and the nginx config is:

...
    location /_x_accel_redirect {
        internal;
        alias /;
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;
        add_header Access-Control-Allow-Origin $upstream_http_access_control_allow_origin;
        add_header Access-Control-Allow-Methods $upstream_http_access_control_allow_methods;
    }
...

[mvdbeek]

That was it, avivator is working via galaxy-web-05, I'll open a PR to the docs and our playbook to make that permanent.
Here's a URL to try https://avivator.gehlenborglab.org/?image_url=https://galaxy-web-05.galaxyproject.org/display_application/f9cad7b01a47213564ccacceb7120aa7/avivator/main/14e6c43ce90708ee/data/galaxy_f9cad7b01a47213564ccacceb7120aa7.tiff

[hexylena]

@mira-miracoli @sanjaysrikakulam could this be copied for EU? You could then remove the one exception for minerva.

[hexylena]

I guess we also need to add this to the nginx/apache docs in galaxy

[mvdbeek]

#17842

[mvdbeek]

And galaxyproject/usegalaxy-playbook#386 for the playbook