Description

This PR adds support for the S3 APIs PutBucketCors, DeleteBucketCors, GetBucketCors and allows the API to use these bucket-specific CORS configurations while falling back to global config where no bucket-specific configuration is given.

Motivation and Context

MinIO has always supported "Global CORS" settings, but has not supported the S3 Bucket Cors APIS:

• https://min.io/docs/minio/kubernetes/upstream/operations/concepts/thresholds.html#unsupported-s3-bucket-apis

The global configuration is done with cors_allow_origin or env var MINIO_API_CORS_ALLOW_ORIGIN, and defaults to origins=*. This is the only CORS configuration that is currently supported.

S3's API, however, allows a user to put a CORS configuration for a given bucket with a rich configuration language, up to 100 rules may be applied. Docs:

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/ManageCorsUsing.html

For example:

<CORSConfiguration>
 <CORSRule>
   <AllowedOrigin>http://www.example1.com</AllowedOrigin>

   <AllowedMethod>PUT</AllowedMethod>
   <AllowedMethod>POST</AllowedMethod>
   <AllowedMethod>DELETE</AllowedMethod>

   <AllowedHeader>*</AllowedHeader>
 </CORSRule>
</CORSConfiguration>

The goal of this PR is to match the S3 rules engine as closely as possible, with a few small exceptions where S3 does not follow the fetch() spec. CORS is made for browsers and thus it's the fetch() spec that defines how it should behave. These exceptions are documented in the functional tests in minio-go. Fetch spec is here:

• https://fetch.spec.whatwg.org/

Another objective is to allow the global CORS settings to continue functioning, without any action required from users who do not apply bucket CORS.

Implementation

MinIO currently uses https://github.com/rs/cors to handle Global CORS.

The intention in this PR is to provide an adapter which can transform a matched S3 Bucket CORS rule, to an rs/cors configuration. This is slightly less efficient than implementing a seperate CORS engine just for the bucket configurations, however, it simplifies things, as there is only one actual cors engine, rs/cors, not two.

The old implementation applies CORS through a handler wrapper, rather than a mux.Middleware. This PR needs to change that, as we now need the bucket name in the CORS handling logic, and the mux router does not provide the bucket var name, unless a route matches.

This PR introduces corsHandler as a real Middleware (added to globalMiddlewares). corsHandler is able to check if a CORS config is applied to a bucket, and if it is, use it instead of the global config.

The disadvantage of using mux.Middleware, is that it's slightly less efficient, as mux sets up the Middleware chain every time there is a route match. This is in contrast to the current global CORS handler wrapper, which is only called once when the router is initialized.

One unavoidable change is that currently preflight is evaluated before any auth, so for example, doing curl -v -XOPTIONS https://play.min.io/minio/kms/v1/status -H "Origin: http://foobar.com/" gives you 200 OK. After this PR, auth will be evaluated first, so it will be access denied. I believe the new code in this PR is a more correct implementation.

How to test this PR?

• Automated tests are provided
• The functional tests in the minio-go repo contain 30 request/response tests that verify CORS correctness.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Optimization (provides speedup with no functional changes)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• Fixes a regression (If yes, please add commit-id or PR # here)
• Unit tests added/updated
• Internal documentation updated
• Create a documentation update request here

All related PRs:

• Implement bucket-level CORS configuration settings with S3 APIs PutBucketCors, etc #20150
• Supporting code for bucket-level CORS configuration settings pkg#123
• Supporting code for bucket-level CORS configuration settings madmin-go#290
• API methods and functional tests for bucket-level CORS configuration settings minio-go#1987