Preflight requests should be available without authentication and authorization #455

New issue

Open

opened 2024-08-09 12:08:09 +00:00 by dkirillov · 1 comment

dkirillov commented

2024-08-09 12:08:09 +00:00

Member

Currently preflight request like this:

$ curl -X OPTIONS http://localhost:8084/test3 -H 'Access-Control-Request-Method: GET' -H 'Origin: *'

failed because of access denied

<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>InternalError</Code><Message>access denied</Message><Resource>/test3</Resource><RequestId>88797679-32ee-4364-ad6d-be0ca877b254</RequestId><HostId>5dcec27c-34e3-468e-8a3f-ffe08950926a</HostId></Error>

In s3-gw logs:

2024-08-09T14:54:13.954+0300    info    middleware/reqinfo.go:191       request start   {"request_id": "88797679-32ee-4364-ad6d-be0ca877b254", "host": "localhost:8084", "remote_host": "::1", "namespace": ""}
2024-08-09T14:54:13.954+0300    debug   middleware/auth.go:57   couldn't receive access box for gate key, random key will be used       {"request_id": "88797679-32ee-4364-ad6d-be0ca877b254", "error": "no authorization header: []"}
2024-08-09T14:54:13.955+0300    info    layer/layer.go:790      resolve bucket  {"request_id": "88797679-32ee-4364-ad6d-be0ca877b254", "cid": "DRYh5v5retURwgDnafoEECA2eThBSBLnAazQH62etxfH"}
2024-08-09T14:54:13.961+0300    error   middleware/policy.go:88 policy validation failed        {"request_id": "88797679-32ee-4364-ad6d-be0ca877b254", "error": "determine properties: determine resource tags: get bucket tagging: access denied: access denied: rpc error: code = Unknown desc = status: code = 2048 message = access to object operation denied"}

But CORS Spec https://fetch.spec.whatwg.org/#cors-protocol-and-credentials says:

a CORS-preflight request never includes credentials.

And AWS allows such requests without any credentials.

I suppose we should do the same.

Describe the solution you'd like

We can move Preflight handler to middlewares.
There are some problem here though: CORs configuration can be stored in bucket to which s3-gw doesn't have access. Using separate container for cors #422 partially solve this. But we still have to go to tree service for bucket settings and we can still have no access.
Probably we can completely move any CORs info into separate container

Describe alternatives you've considered

Don't do anything.

Additional context

No.

cc @alexvanin

## Is your feature request related to a problem? Please describe. Currently preflight request like this: ``` $ curl -X OPTIONS http://localhost:8084/test3 -H 'Access-Control-Request-Method: GET' -H 'Origin: *' ``` failed because of access denied ``` <?xml version="1.0" encoding="UTF-8"?> <Error><Code>InternalError</Code><Message>access denied</Message><Resource>/test3</Resource><RequestId>88797679-32ee-4364-ad6d-be0ca877b254</RequestId><HostId>5dcec27c-34e3-468e-8a3f-ffe08950926a</HostId></Error> ``` In s3-gw logs: ``` 2024-08-09T14:54:13.954+0300 info middleware/reqinfo.go:191 request start {"request_id": "88797679-32ee-4364-ad6d-be0ca877b254", "host": "localhost:8084", "remote_host": "::1", "namespace": ""} 2024-08-09T14:54:13.954+0300 debug middleware/auth.go:57 couldn't receive access box for gate key, random key will be used {"request_id": "88797679-32ee-4364-ad6d-be0ca877b254", "error": "no authorization header: []"} 2024-08-09T14:54:13.955+0300 info layer/layer.go:790 resolve bucket {"request_id": "88797679-32ee-4364-ad6d-be0ca877b254", "cid": "DRYh5v5retURwgDnafoEECA2eThBSBLnAazQH62etxfH"} 2024-08-09T14:54:13.961+0300 error middleware/policy.go:88 policy validation failed {"request_id": "88797679-32ee-4364-ad6d-be0ca877b254", "error": "determine properties: determine resource tags: get bucket tagging: access denied: access denied: rpc error: code = Unknown desc = status: code = 2048 message = access to object operation denied"} ``` But CORS Spec https://fetch.spec.whatwg.org/#cors-protocol-and-credentials says: > a CORS-preflight request never includes credentials. And AWS allows such requests without any credentials. I suppose we should do the same. ## Describe the solution you'd like We can move [Preflight handler](https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/src/commit/3dc989d7fe85dc93752c7c864419a51914be31e5/api/handler/cors.go#L151) to middlewares. There are some problem here though: CORs configuration can be stored in bucket to which s3-gw doesn't have access. Using separate container for cors https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/issues/422 partially solve this. But we still have to go to tree service for bucket settings and we can still have no access. Probably we can completely move any CORs info into separate container ## Describe alternatives you've considered Don't do anything. ## Additional context No. cc @alexvanin

dkirillov commented

2024-08-12 08:20:44 +00:00

Author

Member

In addition we don't support Options methods in s3 actions

In addition we don't support [Options](https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/src/commit/3dc989d7fe85dc93752c7c864419a51914be31e5/api/middleware/constants.go#L8) [methods](https://git.frostfs.info/TrueCloudLab/frostfs-s3-gw/src/commit/3dc989d7fe85dc93752c7c864419a51914be31e5/api/middleware/constants.go#L54) in [s3 actions](https://git.frostfs.info/TrueCloudLab/policy-engine/src/commit/2628f61849843917484db9ad440b9a15c1403339/iam/converter_s3.go#L13)