[openstreetmap/openstreetmap-website] Add CORS headers to `openstreetmap-user-avatars` S3 bucket (Issue #7185)

[Jake Low]

jake-low created an issue (openstreetmap/openstreetmap-website#7185)

### Problem

The avatar URL in `/api/0.6/user/:id` can't be resolved or cached from browser JS because the S3 redirect target lacks permissive CORS headers.



### Description

Currently, the user info endpoint (example: https://www.openstreetmap.org/api/0.6/user/8794039.json) returns an `.img.href` property pointing to the user's avatar. The immediate URL target is a Rails activestorage URL such as this:

```
https://www.openstreetmap.org/rails/active_storage/representations/redirect/eyJfcmFpbHMiOnsiZGF0YSI6MzM3MjY1NTQsInB1ciI6ImJsb2JfaWQifX0=--4aadb4cda4a2611cd615348ac17fb629365e82bb/eyJfcmFpbHMiOnsiZGF0YSI6eyJmb3JtYXQiOiJqcGciLCJyZXNpemVfdG9fbGltaXQiOlsxMDAsMTAwXX0sInB1ciI6InZhcmlhdGlvbiJ9fQ==--71e417a328c02e35ec87b6c7cd4e4524c74e4ec8/profile-picture.jpg
```

Those URLs then redirect to static object URLs in S3, e.g.:

```
https://openstreetmap-user-avatars.s3.dualstack.eu-west-1.amazonaws.com/gxq2fdrjud8ehql1e770pyqm2iud
```

When developing third-party applications that show OSM user profiles, it seems like a good idea to resolve the redirects up front and cache them, both to improve latency when loading the images again later, and to avoid making unnecessary requests on the Rails backend. This is easy to do in server or mobile apps, but in browser JavaScript code, the lack of a CORS `Access-Control-Allow-Origin: *` header on the final S3 URL response means the browser prevents the JS code from resolving the URL or loading the image.

You can still load profile images in third party websites via `<img src>` or similar, which is how most apps I'm familiar with work (MapRoulette and OSMCha for example). But this means that each page load hits the Rails endpoint first to resolve the redirect. And if an app wanted to display a list of many users with profile pictures, it would create a burst of requests, multiplying any problems created both for end users (longer latency to load images) and for the openstreetmap.org website (more load on the Rails backend). 

Note: this would be an ops/configuration change, not a code change in the Rails code; let me know if there's a better place to open such issues in the future.

### Screenshots

_No response_

-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/issues/7185
You are receiving this because you are subscribed to this thread.

Message ID: <openstreetmap/openstreetmap-website/issues/7185 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20260626/737b7d83/attachment-0001.htm>