mirror of
https://github.com/deuxfleurs-org/garage.git
synced 2026-07-26 07:58:14 +00:00
Minkyu Kim
a2c797000f
## Title fix(cors): return single matching origin instead of multiple values in `Access-Control-Allow-Origin` ## Summary This PR fixes bucket CORS responses when a single CORS rule contains multiple `AllowedOrigins`. Previously, Garage returned the configured origins as a comma-separated list in `Access-Control-Allow-Origin`, for example: ```http Access-Control-Allow-Origin: https://app.example.test, https://admin.example.test ``` This is not the expected browser-facing behavior. When a request origin matches a configured rule, the response should reflect **only the matching request origin**, unless the rule contains `*`. ## What changed - `Access-Control-Allow-Origin` now behaves as follows: - returns `*` when the matched rule contains a wildcard origin - otherwise returns the request `Origin` as a **single value** - added `Vary: Origin` when ACAO reflects the request origin - added preflight-specific `Vary` handling in the preflight path for: - `Origin` - `Access-Control-Request-Method` - `Access-Control-Request-Headers` ## Scope This change applies to shared bucket CORS handling paths, including: - S3 API responses - K2V API responses - S3 POST object responses - web bucket responses - preflight (`OPTIONS`) bucket CORS responses This does **not** change admin API fixed CORS behavior. ## Reproduction A direct repro script is included: ```bash ./script/test-cors-multi-origin.sh ``` It exercises two cases against a direct single-node Garage instance: 1. **single-origin control** 2. **multi-origin repro** Before this fix, the multi-origin case returned a comma-separated ACAO value. After this fix, both cases reflect only the request origin. ## Example behavior ### Before ```http Access-Control-Allow-Origin: https://app.example.test, https://admin.example.test ``` ### After ```http Access-Control-Allow-Origin: https://app.example.test ``` ## Tests Added/updated tests in `src/api/common/cors.rs` for: - single-origin control - multiple allowed origins reflecting the request origin - wildcard origin preserving `*` - preserving existing `Vary` values while appending `Origin` ## Validation Used for validation: ```bash cargo test -p garage_api_common cors::tests -- --nocapture cargo build -p garage --bin garage ./script/test-cors-multi-origin.sh ``` ## Reproducibility For reviewers who want to validate behavior by commit: - Before fix: `aa368e4b` - includes the direct repro script and the regression test setup - multi-origin ACAO is reproduced as a comma-separated value - After fix: `f630eb92` - reflects only the matching request origin - preserves wildcard behavior - adds `Vary: Origin` and preflight-specific `Vary` handling Branch: - `fix/cors-multiple-allow-origin` Base used during validation: - `74ad3bf8` (`main-v2`) Closes Deuxfleurs/garage#1149 Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/1419
Garage 
[ Website and documentation | Binary releases | Git repository | Matrix channel ]
Garage is an S3-compatible distributed object storage service designed for self-hosting at a small-to-medium scale.
Garage is designed for storage clusters composed of nodes running at different physical locations, in order to easily provide a storage service that replicates data at these different locations and stays available even when some servers are unreachable. Garage also focuses on being lightweight, easy to operate, and highly resilient to machine failures.
Garage is built by Deuxfleurs, an experimental small-scale self hosted service provider, which has been using it in production since its first release in 2020.
Learn more on our dedicated documentation pages:
Garage is entirely free software released under the terms of the AGPLv3.