xuang7 commented on PR #8562: URL: https://github.com/apache/texera/pull/8562#issuecomment-5720520062
> How was this handled with MinIO? Did it just allow requests from any origin, or did it have CORS headers of it's own that were the same, or different somehow? MinIO has its own CORS layer, controlled by `MINIO_API_CORS_ALLOW_ORIGIN`, which defaults to `*` (see https://docs.min.io/aistor/administration/cors-configuration/). Texera ran on that default, which echoes the requesting origin back and adds Access-Control-Allow-Credentials: true on every response. So under MinIO, we were allowing requests from any origin with credentials. RustFS originally behaved similarly, but after CVE-2026-46685, its default changed to sending no CORS headers. Setting `RUSTFS_CORS_ALLOWED_ORIGINS=*` in this PR restores the required behavior and is actually stricter than the old MinIO default. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
