chiitiler 1.24.2 → 1.24.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -225,6 +225,9 @@ const cache = ChiitilerCache.withMemoryCache(
|
|
|
225
225
|
- **Docker Compose** — see [`docker-compose.yml`](./docker-compose.yml) (includes RustFS + fake-gcs-server for local testing)
|
|
226
226
|
- **AWS Lambda** — ready-to-deploy CDK app in [`cdk/`](./cdk)
|
|
227
227
|
|
|
228
|
+
> [!WARNING]
|
|
229
|
+
> **Do not expose chiitiler directly to the public internet.** Chiitiler fetches whatever the request tells it to: the `url` style and every source, glyph, and sprite URL inside the style (`GET` or `POST`). This allows SSRF — requests to internal networks or cloud metadata endpoints — and reads of local files (`file://`, `mbtiles://`) and buckets (`s3://`, `gs://`) with the server's credentials. Accept requests only from trusted clients, e.g. behind an authenticating proxy or a private network.
|
|
230
|
+
|
|
228
231
|
## Develop
|
|
229
232
|
|
|
230
233
|
Requires Node.js 24.12+ and `sharp` system deps (see [Dockerfile](./Dockerfile)).
|