Skip to main content
When Wherobots Cloud visualizes data read from an S3 bucket, it is important that the bucket allows those CORS requests. When using the Wherobots provided buckets this is already done. If you are using your own bucket, you will need to ensure that the Wherobots domain is allow-listed in the bucket’s CORS policy. This applies whether or not the bucket is connected to Wherobots through an S3 storage integration. A storage integration grants Wherobots server-side access through IAM; the CORS policy governs the browser’s direct HTTPS reads, and the integration’s CloudFormation stacks do not set it for you.

​
What is CORS?

CORS (Cross-Origin Resource Sharing) is a security feature implemented in web browsers that restricts web pages from making requests to a different domain than the one that served the original page. This is a security feature to prevent malicious websites from making requests to other websites on your behalf. You can learn more from wikipedia.

​
Why is this Required?

PMTiles requests are made over http(s) to leverage range requests. Range requests are the basis of the magic that makes reading tiles directly from a PMTiles archive fast without having a dedicated tile server. Since these requests are over http(s) and not directly via the S3 api (ie through an aws sdk) CORS comes into play. This is not specific to PMTiles. The bucket’s CORS policy applies any time the browser loads data from your bucket by URL, which is how Wherobots Cloud renders:
  • Wherobots-GL maps in notebooks, which take the URL of a layer written to your bucket.
  • PMTiles archives opened in the hosted viewer at tile-viewer.wherobots.com.
  • Any other Wherobots Cloud map that reads data straight out of object storage.
Reads that stay server-side are not affected. Compute runtimes reach your bucket through the browser, which CORS does not govern, so reading the same bucket from SQL or a DataFrame works whether or not a CORS policy is in place.

​
How to allow Cross Origin requests from Wherobots Cloud?

To allow CORS requests from Wherobots Cloud, you will need to add a CORS policy to your S3 bucket. If this is the only use of CORS you have, we recommend the following policy:
If you have other use cases for CORS, you will need to collate those rules with the one above. You can learn more about S3 CORS configuration from the AWS documentation.