fix: complete bucket CORS protocol validation

Integrate the strict B3 XML, validation, checksum, wildcard, MaxAge, and Origin-null response contract with the C-prime site-replication register from #75.

Preserve fail-closed metadata behavior and rejected-preflight cache variation while keeping legacy-invalid development metadata readable and repairable through a valid CORS PUT or DELETE.

Add combined parser, handler, browser-response, namespace, replication, restart, and legacy-repair regressions, and update the internal design contract.

Refs #75

Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/api-router.go

@@ -18,6 +18,7 @@
 package cmd
 
 import (
+	"context"
 	"errors"
 	"net"
 	"net/http"
@@ -32,6 +33,8 @@ import (
 	"github.com/rs/cors"
 )
 
+type bucketCorsAppliedKey struct{}
+
 func newHTTPServerFn() *xhttp.Server {
 	globalObjLayerMutex.RLock()
 	defer globalObjLayerMutex.RUnlock()
@@ -652,7 +655,8 @@ func registerAPIRouter(router *mux.Router) {
 // (request is complete). For an actual request it adds the applicable
 // Access-Control-* response headers and returns false so the request
 // continues down the handler chain. If no rule matches a preflight it writes
-// 403 and returns true.
+// 403 and returns true. A matched actual request is marked in its context so
+// inner legacy middleware does not rewrite an explicitly allowed null origin.
 func applyBucketCors(w http.ResponseWriter, r *http.Request, cfg *bktcors.Config) (handled bool) {
 	origin := r.Header.Get("Origin")
 	if origin == "" {
@@ -671,21 +675,21 @@ func applyBucketCors(w http.ResponseWriter, r *http.Request, cfg *bktcors.Config
 		// determine the outcome, including when the request is rejected.
 		h.Add("Vary", "Access-Control-Request-Method")
 		h.Add("Vary", "Access-Control-Request-Headers")
-		rule, allowedOrigin, allowedHeaders, ok := cfg.MatchPreflight(origin, method, reqHeaders)
+		rule, allowedOrigin, allowedHeaders, maxAgeSeconds, ok := cfg.MatchPreflight(origin, method, reqHeaders)
 		if !ok {
 			writeResponse(w, http.StatusForbidden, nil, mimeNone)
 			return true
 		}
 		setBucketCorsOriginHeaders(h, allowedOrigin, origin)
-		h.Set("Access-Control-Allow-Methods", method)
+		h.Set("Access-Control-Allow-Methods", strings.Join(rule.AllowedMethods, ", "))
 		if len(allowedHeaders) > 0 {
 			h.Set("Access-Control-Allow-Headers", strings.Join(allowedHeaders, ", "))
 		}
 		if len(rule.ExposeHeaders) > 0 {
 			h.Set("Access-Control-Expose-Headers", strings.Join(rule.ExposeHeaders, ", "))
 		}
-		if rule.MaxAgeSeconds > 0 {
-			h.Set("Access-Control-Max-Age", strconv.Itoa(rule.MaxAgeSeconds))
+		if maxAgeSeconds != nil {
+			h.Set("Access-Control-Max-Age", strconv.Itoa(*maxAgeSeconds))
 		}
 		writeResponse(w, http.StatusOK, nil, mimeNone)
 		return true
@@ -696,6 +700,7 @@ func applyBucketCors(w http.ResponseWriter, r *http.Request, cfg *bktcors.Config
 	if !ok {
 		return false // no matching rule → no CORS headers, continue normally
 	}
+	*r = *r.WithContext(context.WithValue(r.Context(), bucketCorsAppliedKey{}, struct{}{}))
 	setBucketCorsOriginHeaders(h, allowedOrigin, origin)
 	if len(rule.ExposeHeaders) > 0 {
 		h.Set("Access-Control-Expose-Headers", strings.Join(rule.ExposeHeaders, ", "))
@@ -703,6 +708,11 @@ func applyBucketCors(w http.ResponseWriter, r *http.Request, cfg *bktcors.Config
 	return false
 }
 
+func bucketCorsWasApplied(r *http.Request) bool {
+	_, ok := r.Context().Value(bucketCorsAppliedKey{}).(struct{})
+	return ok
+}
+
 func setBucketCorsOriginHeaders(h http.Header, allowedOrigin, requestOrigin string) {
 	if allowedOrigin == "*" {
 		h.Set("Access-Control-Allow-Origin", "*")

cmd/bucket-cors-adversarial_test.go

@@ -0,0 +1,235 @@
+// Copyright (c) 2015-2021 MinIO, Inc.
+//
+// This file is part of MinIO Object Storage stack
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+package cmd
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/binary"
+	"hash/crc32"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/minio/minio/internal/auth"
+)
+
+func TestPutBucketCorsWireValidation(t *testing.T) {
+	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{
+		t:          t,
+		objAPITest: testPutBucketCorsWireValidation,
+		endpoints:  []string{"PutBucketCors"},
+	})
+}
+
+func testPutBucketCorsWireValidation(_ ObjectLayer, _ string, bucketName string, apiRouter http.Handler,
+	creds auth.Credentials, t *testing.T,
+) {
+	valid := `<CORSConfiguration><CORSRule><AllowedOrigin>*</AllowedOrigin><AllowedMethod>GET</AllowedMethod></CORSRule></CORSConfiguration>`
+	rule := `<CORSRule><AllowedOrigin>*</AllowedOrigin><AllowedMethod>GET</AllowedMethod></CORSRule>`
+	tests := []struct {
+		name     string
+		body     string
+		want     int
+		wantCode string
+	}{
+		{
+			name:     "second XML root",
+			body:     valid + `<Extra/>`,
+			want:     http.StatusBadRequest,
+			wantCode: "MalformedXML",
+		},
+		{
+			name: "255 Unicode character ID",
+			body: `<CORSConfiguration><CORSRule><ID>` + strings.Repeat("界", 255) + `</ID><AllowedOrigin>*</AllowedOrigin><AllowedMethod>GET</AllowedMethod></CORSRule></CORSConfiguration>`,
+			want: http.StatusOK,
+		},
+		{
+			name:     "256 Unicode character ID",
+			body:     `<CORSConfiguration><CORSRule><ID>` + strings.Repeat("界", 256) + `</ID><AllowedOrigin>*</AllowedOrigin><AllowedMethod>GET</AllowedMethod></CORSRule></CORSConfiguration>`,
+			want:     http.StatusBadRequest,
+			wantCode: "MalformedXML",
+		},
+		{
+			name:     "lowercase method",
+			body:     `<CORSConfiguration><CORSRule><AllowedOrigin>*</AllowedOrigin><AllowedMethod>get</AllowedMethod></CORSRule></CORSConfiguration>`,
+			want:     http.StatusBadRequest,
+			wantCode: "MalformedXML",
+		},
+		{
+			name:     "empty origin",
+			body:     `<CORSConfiguration><CORSRule><AllowedOrigin/><AllowedMethod>GET</AllowedMethod></CORSRule></CORSConfiguration>`,
+			want:     http.StatusBadRequest,
+			wantCode: "MalformedXML",
+		},
+		{
+			name:     "question mark origin wildcard",
+			body:     `<CORSConfiguration><CORSRule><AllowedOrigin>https://?.example.com</AllowedOrigin><AllowedMethod>GET</AllowedMethod></CORSRule></CORSConfiguration>`,
+			want:     http.StatusBadRequest,
+			wantCode: "MalformedXML",
+		},
+		{
+			name:     "question mark header wildcard",
+			body:     `<CORSConfiguration><CORSRule><AllowedOrigin>*</AllowedOrigin><AllowedMethod>GET</AllowedMethod><AllowedHeader>x-amz-?</AllowedHeader></CORSRule></CORSConfiguration>`,
+			want:     http.StatusBadRequest,
+			wantCode: "MalformedXML",
+		},
+		{
+			name:     "unknown element",
+			body:     `<CORSConfiguration><CORSRule><AllowedOrigin>*</AllowedOrigin><AllowedMethod>GET</AllowedMethod><Unknown/></CORSRule></CORSConfiguration>`,
+			want:     http.StatusBadRequest,
+			wantCode: "MalformedXML",
+		},
+		{
+			name:     "empty max age",
+			body:     `<CORSConfiguration><CORSRule><AllowedOrigin>*</AllowedOrigin><AllowedMethod>GET</AllowedMethod><MaxAgeSeconds/></CORSRule></CORSConfiguration>`,
+			want:     http.StatusBadRequest,
+			wantCode: "MalformedXML",
+		},
+		{
+			name: "zero max age",
+			body: `<CORSConfiguration><CORSRule><AllowedOrigin>*</AllowedOrigin><AllowedMethod>GET</AllowedMethod><MaxAgeSeconds>0</MaxAgeSeconds></CORSRule></CORSConfiguration>`,
+			want: http.StatusOK,
+		},
+		{
+			name:     "max age int32 overflow",
+			body:     `<CORSConfiguration><CORSRule><AllowedOrigin>*</AllowedOrigin><AllowedMethod>GET</AllowedMethod><MaxAgeSeconds>2147483648</MaxAgeSeconds></CORSRule></CORSConfiguration>`,
+			want:     http.StatusBadRequest,
+			wantCode: "MalformedXML",
+		},
+		{
+			name: "100 rules",
+			body: `<CORSConfiguration>` + strings.Repeat(rule, 100) + `</CORSConfiguration>`,
+			want: http.StatusOK,
+		},
+		{
+			name:     "101 rules",
+			body:     `<CORSConfiguration>` + strings.Repeat(rule, 101) + `</CORSConfiguration>`,
+			want:     http.StatusBadRequest,
+			wantCode: "MalformedXML",
+		},
+		{
+			name: "exactly 64 KiB",
+			body: sizedCORSConfig(maxBucketCorsSize),
+			want: http.StatusOK,
+		},
+		{
+			name:     "over 64 KiB",
+			body:     sizedCORSConfig(maxBucketCorsSize + 1),
+			want:     http.StatusBadRequest,
+			wantCode: "EntityTooLarge",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req, err := newTestSignedRequestV4(http.MethodPut, getBucketCorsURL("", bucketName),
+				int64(len(tt.body)), bytes.NewReader([]byte(tt.body)), creds.AccessKey, creds.SecretKey, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			rec := httptest.NewRecorder()
+			apiRouter.ServeHTTP(rec, req)
+			if rec.Code != tt.want {
+				t.Fatalf("expected status %d, got %d: %s", tt.want, rec.Code, rec.Body.String())
+			}
+			if tt.wantCode != "" && !bytes.Contains(rec.Body.Bytes(), []byte("<Code>"+tt.wantCode+"</Code>")) {
+				t.Fatalf("expected error code %s, got: %s", tt.wantCode, rec.Body.String())
+			}
+		})
+	}
+}
+
+func sizedCORSConfig(size int) string {
+	prefix := `<CORSConfiguration><CORSRule><AllowedOrigin>*</AllowedOrigin><AllowedMethod>GET</AllowedMethod>`
+	suffix := `</CORSRule></CORSConfiguration>`
+	return prefix + strings.Repeat(" ", size-len(prefix)-len(suffix)) + suffix
+}
+
+func TestPutBucketCorsChecksumValidation(t *testing.T) {
+	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{
+		t:          t,
+		objAPITest: testPutBucketCorsChecksumValidation,
+		endpoints:  []string{"PutBucketCors"},
+	})
+}
+
+func testPutBucketCorsChecksumValidation(_ ObjectLayer, _ string, bucketName string, apiRouter http.Handler,
+	creds auth.Credentials, t *testing.T,
+) {
+	body := []byte(`<CORSConfiguration><CORSRule><AllowedOrigin>*</AllowedOrigin><AllowedMethod>GET</AllowedMethod></CORSRule></CORSConfiguration>`)
+	tests := []struct {
+		name      string
+		configure func(*http.Request)
+		want      int
+		wantCode  string
+	}{
+		{
+			name: "missing checksum",
+			configure: func(req *http.Request) {
+				req.Header.Del("Content-Md5")
+			},
+			want:     http.StatusBadRequest,
+			wantCode: "MissingContentMD5",
+		},
+		{
+			name: "bad content md5",
+			configure: func(req *http.Request) {
+				req.Header.Set("Content-Md5", getMD5HashBase64([]byte("different body")))
+			},
+			want:     http.StatusBadRequest,
+			wantCode: "BadDigest",
+		},
+		{
+			name: "valid sdk crc32",
+			configure: func(req *http.Request) {
+				req.Header.Del("Content-Md5")
+				req.Header.Set("X-Amz-Sdk-Checksum-Algorithm", "CRC32")
+				req.Header.Set("X-Amz-Checksum-Crc32", corsCRC32Base64(body))
+			},
+			want: http.StatusOK,
+		},
+		{
+			name: "bad sdk crc32",
+			configure: func(req *http.Request) {
+				req.Header.Del("Content-Md5")
+				req.Header.Set("X-Amz-Sdk-Checksum-Algorithm", "CRC32")
+				req.Header.Set("X-Amz-Checksum-Crc32", corsCRC32Base64([]byte("different body")))
+			},
+			want:     http.StatusBadRequest,
+			wantCode: "BadDigest",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req, err := newTestRequest(http.MethodPut, getBucketCorsURL("", bucketName), int64(len(body)), bytes.NewReader(body))
+			if err != nil {
+				t.Fatal(err)
+			}
+			tt.configure(req)
+			if err = signRequestV4(req, creds.AccessKey, creds.SecretKey); err != nil {
+				t.Fatal(err)
+			}
+			rec := httptest.NewRecorder()
+			apiRouter.ServeHTTP(rec, req)
+			if rec.Code != tt.want || (tt.wantCode != "" && !bytes.Contains(rec.Body.Bytes(), []byte("<Code>"+tt.wantCode+"</Code>"))) {
+				t.Fatalf("expected status %d and code %s, got %d: %s", tt.want, tt.wantCode, rec.Code, rec.Body.String())
+			}
+		})
+	}
+}
+
+func corsCRC32Base64(data []byte) string {
+	var checksum [4]byte
+	binary.BigEndian.PutUint32(checksum[:], crc32.ChecksumIEEE(data))
+	return base64.StdEncoding.EncodeToString(checksum[:])
+}

cmd/bucket-cors-handlers.go

@@ -27,6 +27,7 @@ import (
 	humanize "github.com/dustin/go-humanize"
 	"github.com/minio/madmin-go/v3"
 	"github.com/minio/minio/internal/bucket/cors"
+	hashpkg "github.com/minio/minio/internal/hash"
 	"github.com/minio/minio/internal/logger"
 	"github.com/minio/mux"
 	"github.com/minio/pkg/v3/policy"
@@ -69,9 +70,9 @@ func (api objectAPIHandlers) PutBucketCorsHandler(w http.ResponseWriter, r *http
 		return
 	}
 
-	// PutBucketCors requires a Content-Md5 (or a supported trailing/full
-	// checksum). validateLengthAndChecksum wraps r.Body so the supplied
-	// digest is verified as the body is read below.
+	// PutBucketCors requires a Content-Md5 or a supported full-header
+	// checksum. validateLengthAndChecksum wraps r.Body so the supplied digest
+	// is verified as the body is read below.
 	if !validateLengthAndChecksum(r) {
 		writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrMissingContentMD5), r.URL)
 		return
@@ -79,6 +80,10 @@ func (api objectAPIHandlers) PutBucketCorsHandler(w http.ResponseWriter, r *http
 
 	corsBytes, err := io.ReadAll(r.Body)
 	if err != nil {
+		if errors.Is(err, hashpkg.ErrInvalidChecksum) {
+			writeErrorResponse(ctx, w, errorCodes.ToAPIErr(ErrBadDigest), r.URL)
+			return
+		}
 		writeErrorResponse(ctx, w, toAPIError(ctx, err), r.URL)
 		return
 	}

cmd/bucket-cors-middleware_test.go

@@ -40,6 +40,7 @@ func TestPerBucketCorsPreflight(t *testing.T) {
 	req := httptest.NewRequest(http.MethodOptions, "/mybucket/obj", nil)
 	req.Header.Set("Origin", "http://example.com")
 	req.Header.Set("Access-Control-Request-Method", "GET")
+	req.Header.Set("Access-Control-Request-Headers", "X-Amz-Date")
 
 	handled := applyBucketCors(rec, req, cfg)
 	if !handled {
@@ -48,12 +49,25 @@ func TestPerBucketCorsPreflight(t *testing.T) {
 	if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "http://example.com" {
 		t.Fatalf("allow-origin = %q", got)
 	}
-	if rec.Code != http.StatusOK {
-		t.Fatalf("preflight status = %d", rec.Code)
+	if got := rec.Header().Get("Access-Control-Allow-Credentials"); got != "true" {
+		t.Fatalf("allow-credentials = %q", got)
+	}
+	if got := rec.Header().Get("Access-Control-Allow-Methods"); got != "GET, PUT" {
+		t.Fatalf("allow-methods = %q", got)
+	}
+	if got := rec.Header().Get("Access-Control-Allow-Headers"); got != "X-Amz-Date" {
+		t.Fatalf("allow-headers = %q", got)
 	}
 	if got := rec.Header().Get("Access-Control-Expose-Headers"); got != "ETag" {
 		t.Fatalf("expose-headers = %q", got)
 	}
+	if got := rec.Header().Get("Access-Control-Max-Age"); got != "3000" {
+		t.Fatalf("max-age = %q", got)
+	}
+	requireCorsVary(t, rec.Header())
+	if rec.Code != http.StatusOK {
+		t.Fatalf("preflight status = %d", rec.Code)
+	}
 	requireCorsOriginVary(t, rec.Header())
 }
 
@@ -92,20 +106,24 @@ func TestPerBucketCorsPreflightNoMatch(t *testing.T) {
 	if rec.Code != http.StatusForbidden {
 		t.Fatalf("expected 403 for disallowed origin, got %d", rec.Code)
 	}
+	if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "" {
+		t.Fatalf("rejected preflight returned allow-origin %q", got)
+	}
 	requireCorsVary(t, rec.Header())
 }
 
-func TestPerBucketCorsPreflightWildcardOrigin(t *testing.T) {
-	cfg := &cors.Config{CORSRules: []cors.Rule{{
-		AllowedOrigins: []string{"*"},
-		AllowedMethods: []string{"GET"},
-		AllowedHeaders: []string{"*"},
-		ExposeHeaders:  []string{"ETag"},
-	}}}
+func TestPerBucketCorsPreflightWildcardOriginAndZeroMaxAge(t *testing.T) {
+	doc := `<CORSConfiguration><CORSRule><AllowedOrigin>*</AllowedOrigin><AllowedMethod>GET</AllowedMethod><AllowedMethod>HEAD</AllowedMethod><AllowedHeader>*</AllowedHeader><ExposeHeader>ETag</ExposeHeader><MaxAgeSeconds>0</MaxAgeSeconds></CORSRule></CORSConfiguration>`
+	cfg, err := cors.ParseBucketCorsConfig(strings.NewReader(doc))
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	rec := httptest.NewRecorder()
 	req := httptest.NewRequest(http.MethodOptions, "/mybucket/obj", nil)
 	req.Header.Set("Origin", "https://app.example.com")
-	req.Header.Set("Access-Control-Request-Method", http.MethodGet)
+	req.Header.Set("Access-Control-Request-Method", "GET")
+	req.Header.Set("Access-Control-Request-Headers", "RANGE")
 
 	if handled := applyBucketCors(rec, req, cfg); !handled {
 		t.Fatal("expected preflight to be handled")
@@ -116,12 +134,58 @@ func TestPerBucketCorsPreflightWildcardOrigin(t *testing.T) {
 	if got := rec.Header().Get("Access-Control-Allow-Credentials"); got != "" {
 		t.Fatalf("allow-credentials = %q", got)
 	}
+	if got := rec.Header().Get("Access-Control-Allow-Methods"); got != "GET, HEAD" {
+		t.Fatalf("allow-methods = %q", got)
+	}
+	if got := rec.Header().Get("Access-Control-Allow-Headers"); got != "RANGE" {
+		t.Fatalf("allow-headers = %q", got)
+	}
 	if got := rec.Header().Get("Access-Control-Expose-Headers"); got != "ETag" {
 		t.Fatalf("expose-headers = %q", got)
 	}
+	if got := rec.Header().Get("Access-Control-Max-Age"); got != "0" {
+		t.Fatalf("max-age = %q", got)
+	}
 	requireCorsVary(t, rec.Header())
 }
 
+func TestPerBucketCorsPreflightUsesFirstFullyMatchingRule(t *testing.T) {
+	cfg := &cors.Config{CORSRules: []cors.Rule{
+		{
+			AllowedOrigins: []string{"https://app.example.com"},
+			AllowedMethods: []string{"GET"},
+			AllowedHeaders: []string{"x-a"},
+			ExposeHeaders:  []string{"x-rule-a"},
+			MaxAgeSeconds:  1,
+		},
+		{
+			AllowedOrigins: []string{"https://app.example.com"},
+			AllowedMethods: []string{"GET", "HEAD"},
+			AllowedHeaders: []string{"*"},
+			ExposeHeaders:  []string{"x-rule-b"},
+			MaxAgeSeconds:  2,
+		},
+	}}
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodOptions, "/mybucket/obj", nil)
+	req.Header.Set("Origin", "https://app.example.com")
+	req.Header.Set("Access-Control-Request-Method", "GET")
+	req.Header.Set("Access-Control-Request-Headers", "X-B")
+
+	if handled := applyBucketCors(rec, req, cfg); !handled {
+		t.Fatal("expected preflight to be handled")
+	}
+	if got := rec.Header().Get("Access-Control-Expose-Headers"); got != "x-rule-b" {
+		t.Fatalf("selected rule expose-headers = %q", got)
+	}
+	if got := rec.Header().Get("Access-Control-Allow-Methods"); got != "GET, HEAD" {
+		t.Fatalf("selected rule allow-methods = %q", got)
+	}
+	if got := rec.Header().Get("Access-Control-Max-Age"); got != "2" {
+		t.Fatalf("selected rule max-age = %q", got)
+	}
+}
+
 func TestPerBucketCorsActualRequest(t *testing.T) {
 	cfg := &cors.Config{CORSRules: []cors.Rule{{
 		AllowedOrigins: []string{"*"},
@@ -237,6 +301,66 @@ func testBucketCorsNoConfigUsesGlobalFallback(_ ObjectLayer, _ string, bucket st
 	}
 }
 
+func TestPerBucketCorsActualPatternOriginSupportsCredentials(t *testing.T) {
+	cfg := &cors.Config{CORSRules: []cors.Rule{{
+		AllowedOrigins: []string{"https://*.example.com"},
+		AllowedMethods: []string{"GET"},
+	}}}
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/mybucket/obj", nil)
+	req.Header.Set("Origin", "https://app.example.com")
+
+	if handled := applyBucketCors(rec, req, cfg); handled {
+		t.Fatal("actual request must continue")
+	}
+	if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "https://app.example.com" {
+		t.Fatalf("allow-origin = %q", got)
+	}
+	if got := rec.Header().Get("Access-Control-Allow-Credentials"); got != "true" {
+		t.Fatalf("allow-credentials = %q", got)
+	}
+}
+
+func TestPerBucketCorsActualNullOriginSurvivesForwardingMiddleware(t *testing.T) {
+	next := setBucketForwardingMiddleware(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+
+	t.Run("per-bucket null origin", func(t *testing.T) {
+		cfg := &cors.Config{CORSRules: []cors.Rule{{
+			AllowedOrigins: []string{"null"},
+			AllowedMethods: []string{"GET"},
+		}}}
+		rec := httptest.NewRecorder()
+		req := httptest.NewRequest(http.MethodGet, "/mybucket/obj", nil)
+		req.Header.Set("Origin", "null")
+
+		if handled := applyBucketCors(rec, req, cfg); handled {
+			t.Fatal("actual request must continue")
+		}
+		next.ServeHTTP(rec, req)
+
+		if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "null" {
+			t.Fatalf("allow-origin = %q", got)
+		}
+		if got := rec.Header().Get("Access-Control-Allow-Credentials"); got != "true" {
+			t.Fatalf("allow-credentials = %q", got)
+		}
+	})
+
+	t.Run("legacy unmarked null origin", func(t *testing.T) {
+		rec := httptest.NewRecorder()
+		rec.Header().Set("Access-Control-Allow-Origin", "null")
+		req := httptest.NewRequest(http.MethodGet, "/mybucket/obj", nil)
+
+		next.ServeHTTP(rec, req)
+
+		if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "*" {
+			t.Fatalf("allow-origin = %q", got)
+		}
+	})
+}
+
 func requireCorsVary(t *testing.T, header http.Header) {
 	t.Helper()
 	values := strings.Join(header.Values("Vary"), ",")

cmd/bucket-cors-site-replication_test.go

@@ -20,6 +20,7 @@ package cmd
 import (
 	"bytes"
 	"encoding/base64"
+	"encoding/binary"
 	"encoding/json"
 	"errors"
 	"net/http"
@@ -750,6 +751,65 @@ func TestPeerBucketCorsCreatedAtFloor(t *testing.T) {
 	})
 }
 
+func TestLegacyInvalidCorsMetadataCanBeDeleted(t *testing.T) {
+	ExecObjectLayerAPITest(ExecObjectLayerAPITestArgs{
+		t:          t,
+		objAPITest: testLegacyInvalidCorsMetadataCanBeDeleted,
+		endpoints:  []string{"GetBucketCors"},
+	})
+}
+
+func testLegacyInvalidCorsMetadataCanBeDeleted(obj ObjectLayer, _ string, bucket string, _ http.Handler, _ auth.Credentials, t *testing.T) {
+	ctx := t.Context()
+	meta, err := readBucketMetadata(ctx, obj, bucket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	legacyAt := meta.Created.Add(time.Second)
+	meta.CorsConfigXML = []byte(`<CORSConfiguration><CORSRule><AllowedOrigin>https://app.example.com</AllowedOrigin><AllowedMethod>get</AllowedMethod></CORSRule></CORSConfiguration>`)
+	meta.CorsConfigUpdatedAt = legacyAt
+
+	data := make([]byte, 4, meta.Msgsize()+4)
+	binary.LittleEndian.PutUint16(data[0:2], bucketMetadataFormat)
+	binary.LittleEndian.PutUint16(data[2:4], bucketMetadataVersion)
+	data, err = meta.MarshalMsg(data)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = saveConfig(ctx, obj, pathJoin(bucketMetaPrefix, bucket, bucketMetadataFile), data); err != nil {
+		t.Fatal(err)
+	}
+
+	globalBucketMetadataSys.Remove(bucket)
+	loaded, err := globalBucketMetadataSys.GetConfigFromDisk(ctx, bucket)
+	if err != nil {
+		t.Fatalf("strict load made all bucket metadata unavailable: %v", err)
+	}
+	if loaded.corsConfigErr == nil || loaded.corsConfig != nil {
+		t.Fatalf("legacy CORS state = (%#v, %v), want fail-closed parse error", loaded.corsConfig, loaded.corsConfigErr)
+	}
+	globalBucketMetadataSys.Set(bucket, loaded)
+	if _, gotAt, err := globalBucketMetadataSys.GetCorsConfig(bucket); err == nil || !gotAt.Equal(legacyAt) {
+		t.Fatalf("GetCorsConfig = timestamp %v, error %v; want legacy timestamp and error", gotAt, err)
+	}
+	if _, gotAt, err := globalBucketMetadataSys.GetCorsConfigXML(bucket); err == nil || !gotAt.Equal(legacyAt) {
+		t.Fatalf("GetCorsConfigXML = timestamp %v, error %v; want legacy timestamp and error", gotAt, err)
+	}
+
+	deleteAt, err := updateLocalBucketCORSMetadata(ctx, obj, bucket, nil)
+	if err != nil {
+		t.Fatalf("DELETE could not repair legacy invalid CORS: %v", err)
+	}
+	globalBucketMetadataSys.Remove(bucket)
+	repaired, err := globalBucketMetadataSys.GetConfigFromDisk(ctx, bucket)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if repaired.corsConfigErr != nil || repaired.corsConfig != nil || len(repaired.CorsConfigXML) != 0 || !repaired.CorsConfigUpdatedAt.Equal(deleteAt) {
+		t.Fatalf("repaired CORS state = (%q, %#v, %v, %v), want tombstone at %v", repaired.CorsConfigXML, repaired.corsConfig, repaired.corsConfigErr, repaired.CorsConfigUpdatedAt, deleteAt)
+	}
+}
+
 func testPeerBucketCorsCreatedAtFloor(_ ObjectLayer, _ string, bucket string, _ http.Handler, _ auth.Credentials, t *testing.T) {
 	ctx := t.Context()
 	meta, err := globalBucketMetadataSys.Get(bucket)

cmd/bucket-metadata-sys.go

@@ -370,6 +370,9 @@ func (sys *BucketMetadataSys) GetCorsConfig(bucket string) (*cors.Config, time.T
 	if err != nil {
 		return nil, time.Time{}, err
 	}
+	if meta.corsConfigErr != nil {
+		return nil, meta.CorsConfigUpdatedAt, meta.corsConfigErr
+	}
 	if meta.corsConfig == nil {
 		return nil, time.Time{}, errConfigNotFound
 	}
@@ -384,6 +387,9 @@ func (sys *BucketMetadataSys) GetCorsConfigXML(bucket string) ([]byte, time.Time
 	if err != nil {
 		return nil, time.Time{}, err
 	}
+	if meta.corsConfigErr != nil {
+		return nil, meta.CorsConfigUpdatedAt, meta.corsConfigErr
+	}
 	if len(meta.CorsConfigXML) == 0 {
 		return nil, time.Time{}, errConfigNotFound
 	}

cmd/bucket-metadata.go

@@ -113,6 +113,7 @@ type BucketMetadata struct {
 	bucketTargetConfig     *madmin.BucketTargets
 	bucketTargetConfigMeta map[string]string
 	corsConfig             *cors.Config
+	corsConfigErr          error
 }
 
 // newBucketMetadata creates BucketMetadata with the supplied name and Created to Now.
@@ -261,6 +262,12 @@ func loadBucketMetadataParse(ctx context.Context, objectAPI ObjectLayer, bucket
 			return b, err
 		}
 	}
+	if b.corsConfigErr != nil {
+		// Keep the rest of the bucket metadata available so an operator can
+		// replace or delete a CORS document accepted by an older, more lenient
+		// build. Defer unrelated metadata migration until CORS is repaired.
+		return b, nil
+	}
 
 	// migrate unencrypted remote targets
 	if err = b.migrateTargetConfig(ctx, objectAPI); err != nil {
@@ -320,10 +327,17 @@ func (b *BucketMetadata) parseAllConfigs(ctx context.Context, objectAPI ObjectLa
 		b.taggingConfig = nil
 	}
 
+	b.corsConfigErr = nil
 	if len(b.CorsConfigXML) != 0 {
-		b.corsConfig, err = cors.ParseBucketCorsConfig(bytes.NewReader(b.CorsConfigXML))
-		if err != nil {
-			return err
+		cfg, corsErr := cors.ParseBucketCorsConfig(bytes.NewReader(b.CorsConfigXML))
+		if corsErr == nil {
+			corsErr = cfg.Validate()
+		}
+		if corsErr != nil {
+			b.corsConfig = nil
+			b.corsConfigErr = fmt.Errorf("invalid bucket CORS configuration: %w", corsErr)
+		} else {
+			b.corsConfig = cfg
 		}
 	} else {
 		b.corsConfig = nil
@@ -522,6 +536,9 @@ func (b *BucketMetadata) Save(ctx context.Context, api ObjectLayer) error {
 	if err := b.parseAllConfigs(ctx, api); err != nil {
 		return err
 	}
+	if b.corsConfigErr != nil {
+		return b.corsConfigErr
+	}
 
 	data := make([]byte, 4, b.Msgsize()+4)
 

cmd/generic-handlers.go

@@ -476,9 +476,10 @@ func setRequestValidityMiddleware(h http.Handler) http.Handler {
 // is obtained from centralized etcd configuration service.
 func setBucketForwardingMiddleware(h http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if origin := w.Header().Get("Access-Control-Allow-Origin"); origin == "null" {
+		if origin := w.Header().Get("Access-Control-Allow-Origin"); origin == "null" && !bucketCorsWasApplied(r) {
 			// This is a workaround change to ensure that "Origin: null"
-			// incoming request to a response back as "*" instead of "null"
+			// incoming request to a response back as "*" instead of "null".
+			// Per-bucket CORS preserves an explicitly allowed "null" origin.
 			w.Header().Set("Access-Control-Allow-Origin", "*")
 		}
 		if globalDNSConfig == nil || !globalBucketFederation ||