fix: add ROOT_PATH_SKIP_PREFIXES to exempt sibling-service links from root_path rewriting#195
Closed
lhoupert wants to merge 2 commits into
Closed
Conversation
… root_path rewriting On shared-host deployments (e.g. eoapi-k8s defaults: proxy at /stac, titiler at /raster, /vector, /browser on one hostname), STAC responses carry same-host links to sibling services. ProcessLinksMiddleware cannot distinguish these from its own links by netloc — with OVERRIDE_HOST=false the upstream generates its links with the request netloc too — so it prepends ROOT_PATH to them, producing broken links (/stac/raster/... 404). Add an opt-in ROOT_PATH_SKIP_PREFIXES setting: same-host links whose path matches a configured prefix (path-segment-aware) are left untouched. Unset (default) keeps behavior unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
lhoupert
marked this pull request as draft
July 22, 2026 15:10
… prefix - add a regression test asserting upstream-host links are still rewritten even when their path matches a skip prefix (the setting describes sibling services on the proxy's public hostname) - raise on a bare '/' prefix instead of silently dropping it (it would otherwise read as 'skip everything' but do nothing) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
lhoupert
force-pushed
the
fix/scope-root-path-link-rewrite
branch
from
July 22, 2026 15:37
668cc3b to
286d8db
Compare
lhoupert
marked this pull request as ready for review
July 22, 2026 15:45
alukach
self-requested a review
July 23, 2026 06:47
Contributor
Contributor
Author
|
close for duplicate #198 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #196
🤖 Claude text below 🤖
On shared-host deployments (e.g. eoapi-k8s defaults: this proxy at
/stacwith titiler at/raster,/vector,/browseron the same hostname), STAC items carry same-host links to sibling services (rel=xyz,tilejson,viewer, ...).ProcessLinksMiddlewareprependsROOT_PATHto every same-host link, sohttps://host/raster/...is served ashttps://host/stac/raster/...→ 404. Netloc can't disambiguate these: withOVERRIDE_HOST=falsethe upstream honours forwarded headers and generates its own links with the request netloc too, and those must keep gettingROOT_PATH(pertest_transform_with_forwarded_headers).This adds an opt-in
ROOT_PATH_SKIP_PREFIXESsetting (comma-separated path prefixes, e.g./raster,/vector,/browser): same-host links whose path matches a configured prefix are left untouched. Matching is path-segment-aware (/rastermatches/rasterand/raster/..., not/rasterfoo); trailing slashes are normalized. Unset (the default) leaves behaviour byte-identical to today — all existing tests pass unchanged; regression tests and docs added.We hit this in production at EOPF-Explorer/platform-deploy#343 and currently run this guard as a patched image.
Author attestation
AI-assisted: implementation and tests drafted with Claude, reviewed by me, and validated against the full test suite (478 passed) and pre-commit hooks (ruff, isort, mypy).