diff options
| author | 粒粒橙 <i@llc.moe> | 2025-11-25 22:19:34 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-11-25 06:19:34 -0800 |
| commit | a24c31de06093337cd31e42ed94de67ce1d5c95b (patch) | |
| tree | 5d68d38ff8f2b918a9c2cd25a84dcfd4dece7289 /weed/s3api | |
| parent | 935c641f2557ce08c05e97ea4cac178e872d06d7 (diff) | |
| download | seaweedfs-a24c31de06093337cd31e42ed94de67ce1d5c95b.tar.xz seaweedfs-a24c31de06093337cd31e42ed94de67ce1d5c95b.zip | |
S3: Add `Vary` header for non-wildcard AllowOrigin (#7547)
Diffstat (limited to 'weed/s3api')
| -rw-r--r-- | weed/s3api/cors/cors.go | 4 | ||||
| -rw-r--r-- | weed/s3api/cors/cors_test.go | 2 |
2 files changed, 6 insertions, 0 deletions
diff --git a/weed/s3api/cors/cors.go b/weed/s3api/cors/cors.go index d6eb520af..ac9e7cca3 100644 --- a/weed/s3api/cors/cors.go +++ b/weed/s3api/cors/cors.go @@ -361,6 +361,10 @@ func ApplyHeaders(w http.ResponseWriter, corsResp *CORSResponse) { if corsResp.AllowOrigin != "" { w.Header().Set("Access-Control-Allow-Origin", corsResp.AllowOrigin) + + if corsResp.AllowOrigin != "*" { + w.Header().Add("Vary", "Origin") + } } if corsResp.AllowMethods != "" { diff --git a/weed/s3api/cors/cors_test.go b/weed/s3api/cors/cors_test.go index 1b5c54028..8494a284d 100644 --- a/weed/s3api/cors/cors_test.go +++ b/weed/s3api/cors/cors_test.go @@ -480,6 +480,7 @@ func TestApplyHeaders(t *testing.T) { "Access-Control-Allow-Headers": "Content-Type", "Access-Control-Expose-Headers": "ETag", "Access-Control-Max-Age": "3600", + "Vary": "Origin", }, }, { @@ -493,6 +494,7 @@ func TestApplyHeaders(t *testing.T) { "Access-Control-Allow-Origin": "http://example.com", "Access-Control-Allow-Methods": "GET", "Access-Control-Allow-Credentials": "true", + "Vary": "Origin", }, }, } |