Bug #15348: CORS: Access-Control-Allow-Origin should return * when set that way - rgw - Ceph

Actions

Copy link

Bug #15348

closed

CORS: Access-Control-Allow-Origin should return * when set that way

Added by Wido den Hollander about 8 years ago. Updated over 7 years ago.

Status:

Resolved

Priority:

Normal

Assignee:

Target version:

% Done:

Source:

Community (dev)

Tags:

Backport:

hammer,jewel

Regression:

Severity:

3 - minor

Reviewed:

Affected Versions:

ceph-qa-suite:

Pull request ID:

Crash signature (v1):

Crash signature (v2):

Description

When using CORS with RGW it will return a Access-Control-Allow-Origin when CORS is enabled.

The requester sends a 'Origin' header and RGW will now return the content of the 'Origin' header as a value for the 'Access-Control-Allow-Origin' response header.

For example, a client sends:

GET /bucket/object
Origin: foo

RGW will respond with:

200 OK
Access-Control-Allow-Origin: foo

In this case the policy might be set to * (Asterisk).

Looking at the code RGW seems to check if the origin has been set to * in the policy and return the Origin request header.

When using RGW as a CDN for Fonts this fails. If a user switches Origin a browser will not perform the request again. But since the Origin it not in Access-Control-Allow-Origin it will not load the fonts.

RGW should respond with 'Access-Control-Allow-Origin' set to * when this is set in the policy of the bucket/object.

Related issues 2 (0 open — 2 closed)