Process CORS earlier in pipeline #254

Merged

lx merged 3 commits from better-cors into main

2022-03-01 10:19:19 +00:00

lx commented

2022-02-28 11:23:33 +00:00

Owner

Process OPTIONS before checking if request is authenticated, because when a browser preflights an authenticated request, the OPTIONS itself is not authenticated
Answer to OPTIONS on ListBuckets (the only endpoint that doesn't have a bucket name)

CAVEAT: We can't handle OPTIONS on local bucket names... this will possibly be a blocker for making a web UI that talks to garage

- Process `OPTIONS` **before** checking if request is authenticated, because when a browser preflights an authenticated request, the `OPTIONS` itself is not authenticated - Answer to `OPTIONS` on `ListBuckets` (the only endpoint that doesn't have a bucket name) **CAVEAT:** We can't handle `OPTIONS` on local bucket names... this will possibly be a blocker for making a web UI that talks to garage

lx added 2 commits 2022-02-28 11:23:35 +00:00

8129a98291

Process CORS earlier in pipeline

continuous-integration/drone/pr Build is passing Details

continuous-integration/drone/push Build is passing Details

97f245f218

Add tracing output to signature calculation

lx added 1 commit 2022-03-01 10:15:30 +00:00

continuous-integration/drone/pr Build is passing Details

continuous-integration/drone/push Build is passing Details

continuous-integration/drone/tag Build is passing Details

continuous-integration/drone Build is passing Details

8a5bbc3b0b

More permissive OPTIONS on S3 API

lx commented

2022-03-01 10:18:50 +00:00

Author

Owner

Here is a (temporary) solution: OPTIONS calls do not match local bucket names, since these requests are not authenticated. CORS parameters of a global bucket with the same name will overshadow CORS parameters of the bucket with the local name. If there is no bucket in the global namespace with that name, CORS headers that allow everything are returned, so as to not prevent us from developping web apps that makes use of local bucket aliases.

Security notice: CORS cannot be relied for as a security measure for bucket with local aliases. Make sure you handle your S3 API keys properly, that's the only way to properly secure access to the API.

Here is a (temporary) solution: `OPTIONS` calls do not match local bucket names, since these requests are not authenticated. CORS parameters of a global bucket with the same name will overshadow CORS parameters of the bucket with the local name. If there is no bucket in the global namespace with that name, CORS headers that allow everything are returned, so as to not prevent us from developping web apps that makes use of local bucket aliases. **Security notice:** CORS cannot be relied for as a security measure for bucket with local aliases. Make sure you handle your S3 API keys properly, that's the only way to properly secure access to the API.

lx merged commit 8a5bbc3b0b into main

2022-03-01 10:19:19 +00:00

lx referenced this pull request

2022-03-01 10:22:54 +00:00

CORS parameters not taken in account on OPTIONS calls to buckets with local names #258

No reviewers