Exclude JSON from CORS FilesMatch to fix duplicate API header

Author: Rub21

images/web/Dockerfile

@@ -24,7 +24,7 @@ RUN apt-get update && \
     && apt-get clean && rm -rf /var/lib/apt/lists/*
 
 # Download OHM Website using gitsha, faster than cloning
-ENV OPENHISTORICALMAP_WEBSITE_GITSHA=5f96c54eca693db48ad272b1be32d2a2f90a796b
+ENV OPENHISTORICALMAP_WEBSITE_GITSHA=a9a92c5ac3554ffeca489450e020de708c09e436
 ENV OHM_WEBSITE_URL=https://github.com/OpenHistoricalMap/ohm-website/archive/${OPENHISTORICALMAP_WEBSITE_GITSHA}.zip
 RUN rm -rf $workdir/* && curl -fsSL $OHM_WEBSITE_URL -o /tmp/ohm-website.zip && \
     unzip /tmp/ohm-website.zip -d /tmp && \

images/web/config/production.conf

@@ -64,8 +64,10 @@
         Header set Access-Control-Allow-Origin "*"
     </Directory>
 
-    # Allow CORS for JSON, PBF, and PNG files for map-style
-    <FilesMatch "\.(json|pbf|png)$">
+    # Allow CORS for PBF and PNG files for map-style.
+    # JSON is excluded so /api/*.json keeps only the header Rails sends, avoiding a
+    # duplicate "*, *" (issue #1377).
+    <FilesMatch "\.(pbf|png)$">
         Header set Access-Control-Allow-Origin "*"
         Header set Access-Control-Allow-Methods "GET, OPTIONS"
         Header set Access-Control-Allow-Headers "Content-Type"