Test OpenSeadragon and Mirador to make sure CORS configuration is not necessary

[mjordan]

Coming out of a discussion over at #1294 between me and @seth-shaw-unlv, we should test OpenSeadragon in a variety of client/server IP address combinations to make sure that we don't need to configure Drupal's CORS settings. I have been seeing some inconsistent behaviors testing Islandora on my home network using 192.168. addresses and public IP addresses. The OpenSeadragon github issue queue has lots of references to CORS so I suspect that we'll need to document something around this.

CORS is, apparently, not documented anywhere on the d.o. website yet the options exist in sites/default/default.services.yml, which must be adjusted and then copied to sites/default/services.yml, and then cache cleared.

[mjordan]

We should test Mirador too when Islandora/islandora_defaults#10 gets merged (or even prior to that).

[mjordan]

Some useful examples at https://www.drupal.org/node/2715637.

[dannylamb]

Bumping into this now with ISLE and openseadragon. It's totally a thing.

[dannylamb]

Just to circle back to this one. We solved this in ISLE with Traefik (the front end proxy to the whole stack). TL;DR even though they're separate containers/servers, if you expose cantaloupe and matomo as sub-paths off the main site, there's no CORS. E.g. if your Drupal is at http://example.org, cantaloupe is at http://example.org/cantaloupe and matomo is at http://example.org/matomo. Otherwise, yes, you gotta set up CORS and it's a PITA.

[dannylamb]

I think we can close this one. Feel free to re-open if neccessary.