astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-09-05 18:16:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix: keep the CORS lookup fail-closed until bucket metadata is loaded

Browse Source 
Restore the startup guard removed by the previous cleanup: while bucket
metadata is still loading, a non-resident name may be a bucket with a
restrictive CORS document, so the request gets no CORS answer instead of the
global policy. After startup a non-resident name still falls back to the
global policy without any metadata I/O; the separate load-failure set stays
removed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PvgysXDmhPBBimCReYtA8q
Signed-off-by: Feng Ruohang <rh@vonng.com>
This commit is contained in:
Feng Ruohang
2026-09-02 18:49:17 +08:00
parent 21646eebd2
commit ec2979ca48
3 changed files with 18 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/api-router.go
+4 -3
View File
@@ -789,9 +789,10 @@ func corsHandler(handler http.Handler) http.Handler {
if bucket, _ := request2BucketObjectName(r); bucket != "" && globalBucketMetadataSys != nil {
// Resident-only lookup: this runs before authentication with a
// client-supplied path segment as the bucket name, so it must
// never load or cache metadata. A bucket with a stored CORS
// document that failed to parse gets no CORS headers; any other
// non-resident name falls back to the global policy below.
// never load or cache metadata. While startup loading is still
// running, and for a bucket whose stored CORS document failed to
// parse, the request gets no CORS headers; any other non-resident
// name falls back to the global policy below.
cfg, _, err := globalBucketMetadataSys.GetResidentCorsConfig(bucket)
if err == nil && cfg != nil {
if applyBucketCors(w, r, cfg) {