Add CORS support, disabled by default since we assume your reverse pr…

…oxy handles this.

README.md

@@ -69,6 +69,7 @@ GLOBAL OPTIONS:
    --config-file value     reference to YAML configuration file [$CONFIG_FILE]
    --openapi-file value    reference to a (customized) OGC OpenAPI spec for the dynamic parts of your OGC API [$OPENAPI_FILE]
    --allow-trailing-slash  support API calls to URLs with a trailing slash (default: false) [$ALLOW_TRAILING_SLASH]
+   --enable-cors           enable Cross-Origin Resource Sharing (CORS) as required by OGC API specs. Disable if you handle CORS elsewhere. (default: false) [$ENABLE_CORS]
    --help, -h              show help
 ```
 

go.mod

@@ -9,6 +9,7 @@ require (
 	github.com/elnormous/contenttype v1.0.4
 	github.com/getkin/kin-openapi v0.116.0
 	github.com/go-chi/chi/v5 v5.0.8
+	github.com/go-chi/cors v1.2.1
 	github.com/go-playground/validator/v10 v10.13.0
 	github.com/go-spatial/geom v0.0.0-20220918193402-3cd2f5a9a082
 	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572

go.sum

@@ -20,6 +20,8 @@ github.com/getkin/kin-openapi v0.116.0 h1:o986hwgMzR972JzOG5j6+WTwWqllZLs1EJKMKC
 github.com/getkin/kin-openapi v0.116.0/go.mod h1:l5e9PaFUo9fyLJCPGQeXI2ML8c3P8BHOEV2VaAVf/pc=
 github.com/go-chi/chi/v5 v5.0.8 h1:lD+NLqFcAi1ovnVZpsnObHGW4xb4J8lNmoYVfECH1Y0=
 github.com/go-chi/chi/v5 v5.0.8/go.mod h1:DslCQbL2OYiznFReuXYUmQ2hGd1aDpCnlMNITLSKoi8=
+github.com/go-chi/cors v1.2.1 h1:xEC8UT3Rlp2QuWNEr4Fs/c2EAGVKBwy/1vHx3bppil4=
+github.com/go-chi/cors v1.2.1/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
 github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
 github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=

main.go

@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"os"
 	"strconv"
+	"time"
 
 	gokoalaEngine "github.com/PDOK/gokoala/engine"
 	"github.com/PDOK/gokoala/ogc/common/core"
@@ -17,6 +18,7 @@ import (
 	"github.com/PDOK/gokoala/ogc/tiles"
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
+	"github.com/go-chi/cors"
 	"github.com/urfave/cli/v2"
 )
 
@@ -73,6 +75,13 @@ func main() {
 			Required: false,
 			EnvVars:  []string{"ALLOW_TRAILING_SLASH"},
 		},
+		&cli.BoolFlag{
+			Name:     "enable-cors",
+			Usage:    "enable Cross-Origin Resource Sharing (CORS) as required by OGC API specs. Disable if you handle CORS elsewhere.",
+			Value:    false,
+			Required: false,
+			EnvVars:  []string{"ENABLE_CORS"},
+		},
 	}
 
 	app.Action = func(c *cli.Context) error {
@@ -87,7 +96,7 @@ func main() {
 		// Engine encapsulates shared non-OGC API specific logic
 		engine := gokoalaEngine.NewEngine(configFile, openAPIFile)
 
-		router := newRouter(engine, c.Bool("allow-trailing-slash"))
+		router := newRouter(engine, c.Bool("allow-trailing-slash"), c.Bool("enable-cors"))
 
 		return engine.Start(address, router, debugPort, shutdownDelay)
 	}
@@ -98,14 +107,24 @@ func main() {
 	}
 }
 
-func newRouter(engine *gokoalaEngine.Engine, allowTrailingSlash bool) *chi.Mux {
+func newRouter(engine *gokoalaEngine.Engine, allowTrailingSlash bool, enableCORS bool) *chi.Mux {
 	router := chi.NewRouter()
 	router.Use(middleware.Logger)
 	router.Use(middleware.Recoverer)
 	router.Use(middleware.RealIP)
 	if allowTrailingSlash {
 		router.Use(middleware.StripSlashes)
 	}
+	if enableCORS {
+		router.Use(cors.Handler(cors.Options{
+			AllowedOrigins:   []string{"*"},
+			AllowedMethods:   []string{"GET", "OPTIONS"},
+			AllowedHeaders:   []string{"X-Requested-With"},
+			ExposedHeaders:   []string{"Content-Crs", "Link"},
+			AllowCredentials: false,
+			MaxAge:           int((time.Hour * 24).Seconds()),
+		}))
+	}
 	// implements https://gitdocumentatie.logius.nl/publicatie/api/adr/#api-57
 	router.Use(middleware.SetHeader("API-Version", engine.Config.Version))
 	router.Use(middleware.Compress(5)) // enable gzip responses