The current code taking care of CORS return 403 errors when the Origin header in the client request does not match the CORS=xxx parameter in renderd.conf or when this parameter is missing.
It does not seem logical as CORS is to be handled by the client, not by the server.
It could be seen as a way to limit access to the tileserver but in fact, this test is done by mod_tile AFTER calling renderd and generating the metatile.
I don't really understand the logic, that why I have no PR to offer so far.
The current code taking care of CORS return 403 errors when the Origin header in the client request does not match the CORS=xxx parameter in renderd.conf or when this parameter is missing.
It does not seem logical as CORS is to be handled by the client, not by the server.
It could be seen as a way to limit access to the tileserver but in fact, this test is done by mod_tile AFTER calling renderd and generating the metatile.
I don't really understand the logic, that why I have no PR to offer so far.