gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-10 23:26:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

security: same-origin console CORS, fail-closed helm creds, deny.toml, sample-config hardening (#2769)

Browse Source 
Signed-off-by: Michael Graff <explorer@flame.org>
Signed-off-by: 安正超 <anzhengchao@gmail.com>
Co-authored-by: 安正超 <anzhengchao@gmail.com>
Co-authored-by: loverustfs <hello@rustfs.com>
This commit is contained in:
Michael Graff
2026-05-06 02:34:44 -05:00
committed by GitHub
parent 718bec7722
commit 3898d524fe
9 changed files with 373 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/config/src/constants/console.rs
+10 -4
View File
@@ -24,8 +24,14 @@ pub const DEFAULT_CORS_ALLOWED_ORIGINS: &str = "";
/// Comma-separated list of origins or "*" for all origins
pub const ENV_CONSOLE_CORS_ALLOWED_ORIGINS: &str = "RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS";
/// Default CORS allowed origins for the console service
pub const DEFAULT_CONSOLE_CORS_ALLOWED_ORIGINS: &str = "*";
/// Default CORS allowed origins for the console service.
///
/// Empty string means same-origin only — no `Access-Control-Allow-Origin`
/// header is emitted, so browsers will not allow cross-origin reads of
/// console responses by default. Operators that need cross-origin access set
/// `RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS` to a comma-separated allow-list, or
/// to `*` to keep the previous permissive behavior.
pub const DEFAULT_CONSOLE_CORS_ALLOWED_ORIGINS: &str = "";
/// Enable or disable the console service
pub const ENV_CONSOLE_ENABLE: &str = "RUSTFS_CONSOLE_ENABLE";
@@ -100,8 +106,8 @@ mod tests {
}
#[test]
fn console_cors_default_remains_wildcard() {
fn console_cors_default_is_same_origin_only() {
assert_eq!(ENV_CONSOLE_CORS_ALLOWED_ORIGINS, "RUSTFS_CONSOLE_CORS_ALLOWED_ORIGINS");
assert_eq!(DEFAULT_CONSOLE_CORS_ALLOWED_ORIGINS, "*");
assert_eq!(DEFAULT_CONSOLE_CORS_ALLOWED_ORIGINS, "");
}
}