X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/3b563e12600d3519011cde414ee0465698a7814f..123c68fc9a445f5c712226ec311d6a47c89d5270:/cookbooks/overpass/templates/default/apache.erb

diff --git a/cookbooks/overpass/templates/default/apache.erb b/cookbooks/overpass/templates/default/apache.erb
index fbf82cf04..8ccd28a9d 100644
--- a/cookbooks/overpass/templates/default/apache.erb
+++ b/cookbooks/overpass/templates/default/apache.erb
@@ -29,12 +29,18 @@
 
         DocumentRoot <%= @directory %>
 
+        RewriteEngine on
+        RewriteMap totp prg:/srv/query.openstreetmap.org/apache/totp-filter
+        RewriteCond ${totp:%{HTTP_COOKIE}} =0
+        RewriteRule ^/query-features - [F,L]
+
 <% if node[:overpass][:restricted_api] -%>
         ScriptAlias /query-features <%= @script_directory %>/interpreter
         SetEnvIf Origin "http.*(osm.org|openstreetmap.org).*" AccessControlAllowOrigin=$0
         # Remove Origin so Overpass does not interfere.
         RequestHeader unset Origin
         Header always add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin
+        Header always add Access-Control-Allow-Credentials true
 <% else -%>
         ScriptAlias /api/ <%= @script_directory %>/
 <% end -%>