Restrict image or STAC Item URL

[philvarner]

I see one issue with production TiTiler deployments is that they are entirely open to the world, and anyone can use them to tile any arbitrary image or STAC Item URL. The only way to restrict this (somewhat) is with a CORS header (to prevent embedding in a browser without using CORS plugin to turn off those protections). The configuration for S3 Buckets grants permissions on non-public S3 buckets, but doesn't restrict tiling of data in public ones AFAIK.

The behavior I would like to propose here is a configuration like:

TITILER_API_COG_PREFIXES = ["https://sentinel-cogs.s3.us-west-2.amazonaws.com", "https://landsat8-cogs.s3.us-west-2.amazonaws.com"] 
TITILER_API_STAC_PREFIXES = ["https://earth-search.aws.element84.com", "https://sentinel-stac.s3.us-west-2.amazonaws.com"]

That restricts the cog and stac tiling to only working with url parameter values that started with any of those. This would at least restrict the data that could be tiled, for example, my titiler instance would be configured to only tile STAC items from my STAC API.

[vincentsarago]

I see one issue with production TiTiler deployments

Production stack should implement auth, but this is IMO out of the scope of titiler.

That restricts the cog and stac tiling to only working with url parameter values that started with any of those.

This can totally be achieved with a custom DatasetPathParams for each of the Factory https://github.com/developmentseed/titiler/blob/master/src/titiler/core/titiler/core/dependencies.py#L80-L83