gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-19 02:56:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(auth): log structured denial reasons for generic AccessDenied responses (#5761)

Browse Source
This commit is contained in:
Zhengchao An
2026-08-06 10:45:54 +08:00
committed by GitHub
parent dbf51117a1
commit efd5481b35
6 changed files with 123 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rustfs/src/app/bucket_usecase.rs
+8
View File
@@ -800,6 +800,8 @@ async fn is_list_objects_metadata_action_allowed<T>(
req_info.bucket = Some(bucket.to_string());
req_info.object = Some(object.to_string());
req_info.version_id = None;
// Denial here is an expected filter outcome, not an error (issue #5740).
req_info.suppress_denial_log = true;
auth_req.extensions.insert(req_info);
match authorize_request(&mut auth_req, Action::S3Action(action)).await {
@@ -1392,6 +1394,12 @@ impl DefaultBucketUsecase {
return Err(S3Error::with_message(S3ErrorCode::AccessDenied, "Access Denied"));
}
// The ListAllMyBuckets probe and the per-bucket probes cloned from this
// request treat denial as an expected filter outcome (issue #5740).
if let Some(req_info) = req.extensions.get_mut::<ReqInfo>() {
req_info.suppress_denial_log = true;
}
let bucket_infos = if let Err(e) = authorize_request(&mut req, Action::S3Action(S3Action::ListAllMyBucketsAction)).await {
if e.code() != &S3ErrorCode::AccessDenied {
return Err(e);