403 errors on tiles after upgrade to 2.2

[rbovard]

• GeoMapFish version: 2.2.1

After upgrade to 2.2, my tiles are no more accessible (503), see background in https://map-demo.nyon.ch/dev/

It works fine in 2.1.

[rbovard]

FYI DEV instance is down because of https://github.com/camptocamp/c2cgeoportal/issues/3308#issuecomment-350992861

[ochriste]

hello

the 403 on tiles are caused by the special "# Secure WMTS" apache rules in the file apache/private.conf

so you will have to fix the this rules if you want the tiles to display correctly

[rbovard]

But I didn't changed this rule and it was working in 2.1.

[ochriste]

well all I can say is now the rule dont work, I havent analysed why yet

[ochriste]

this rule has never worked for dev:

Allow from env=map Allow from env=map-demo Allow from env=geoadmin because the dev env is not included

maybe it has worked by error if the dev project was using demo tile urls or something like that

[rbovard]

No, my dev was working as excepted in 2.1.

[ochriste]

well, Im sorry it doesnt work anymore and I have no explanation why because it was not logical it had ever worked, I can try to adapt your rule to make it work though, I will have a look.

[rbovard]

Something had changed in 2.2: Require ip 127.0.0.1 ::1 is added?!

DEMO (OK):

<Location /demo/tiles>
    ...
    Allow from 127.0.0.1 ::1
    ...
</Location>

DEV (KO):

<Location /dev/tiles>
    ...
    Allow from 127.0.0.1 ::1
Require ip 127.0.0.1 ::1
    ...
</Location>

[rbovard]

I found the commit: https://github.com/camptocamp/c2cgeoportal/commit/9b3f23c1789b156c8a17fb1312eb0efd300051cb

[ochriste]

ah I see, you re-used the "mapserv_allow" variable in your private.conf.mako, then just make a new variable in your .mk that doesnt include the "Require ip" statement

[rbovard]

Yes because I wanted to use the same protection as for MapServer...

Why does it not work for /tiles and work for /mapserv and /mapserv_proxy? What does the Require ip 127.0.0.1 ::1?

[ochriste]

because /mapserv is only accessed from localhost, while /tiles is accessed from outside, so you cant use the same access rules

I do not know why the Require ip was added, I will ask @sbrunner

[rbovard]

/mapserv_proxy is accessed from outside and it works with Require ip 127.0.0.1 ::1 (I have tested this morning)

[ochriste]

/mapserv is not /mapserv_proxy

[rbovard]

I know... But I can access it from outside with Require ip 127.0.0.1 ::1 https://github.com/camptocamp/nyon_c2cgeoportal/blob/v22/apache/private.conf.mako#L17

[ochriste]

Im sorry, I do not understand what you want exactly.

[rbovard]

Never mind, I'll close this issue since it's related to my config...