From f065e8acdc3bcbfd36abc6091cf1881cf64057fb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rn=20Friedrich=20Dreyer?= Date: Thu, 20 Aug 2026 14:28:42 +0200 Subject: [PATCH] expect only the tus related cors allow header values MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Jörn Friedrich Dreyer --- services/storage-users/pkg/config/defaults/defaultconfig.go | 2 ++ tests/acceptance/features/apiCors/cors.feature | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/services/storage-users/pkg/config/defaults/defaultconfig.go b/services/storage-users/pkg/config/defaults/defaultconfig.go index 5ed8766d93..504798445f 100644 --- a/services/storage-users/pkg/config/defaults/defaultconfig.go +++ b/services/storage-users/pkg/config/defaults/defaultconfig.go @@ -60,6 +60,7 @@ func DefaultConfig() *config.Config { "Upload-Metadata", "Upload-Defer-Length", "Upload-Concat", + "Upload-Complete", "Upload-Incomplete", "Upload-Draft-Interop-Version", }, @@ -75,6 +76,7 @@ func DefaultConfig() *config.Config { "Upload-Metadata", "Upload-Defer-Length", "Upload-Concat", + "Upload-Complete", "Upload-Incomplete", "Upload-Draft-Interop-Version", }, diff --git a/tests/acceptance/features/apiCors/cors.feature b/tests/acceptance/features/apiCors/cors.feature index 9b8f51d364..01933cfd3f 100644 --- a/tests/acceptance/features/apiCors/cors.feature +++ b/tests/acceptance/features/apiCors/cors.feature @@ -152,13 +152,13 @@ Feature: CORS headers When user "Alice" sends HTTP method "OPTIONS" to URL "" with headers | header | value | | Origin | https://aphno.badal | - | Access-Control-Request-Headers | accept,authorization,cache-control,content-type,depth,destination,if-match,if-none-match,ocs-apirequest,origin,overwrite,tus-checksum-algorithm,tus-resumable,upload-checksum,upload-concat,upload-defer-length,upload-expires,upload-length,upload-metadata,upload-offset,x-http-method-override,x-request-id,x-requested-with | + | Access-Control-Request-Headers | Authorization,Origin,X-Requested-With,X-Request-Id,X-HTTP-Method-Override,Content-Type,Upload-Length,Upload-Offset,Tus-Resumable,Upload-Metadata,Upload-Defer-Length,Upload-Concat,Upload-Complete,Upload-Incomplete,Upload-Draft-Interop-Version | | Access-Control-Request-Method | | # the tus handler returns 200 to be compatible with older browsers that don't support 204 for OPTIONS requests And the HTTP status code should be "200" And the following headers should be set | header | value | - | Access-Control-Allow-Headers | accept,authorization,cache-control,content-type,depth,destination,if-match,if-none-match,ocs-apirequest,origin,overwrite,tus-checksum-algorithm,tus-resumable,upload-checksum,upload-concat,upload-defer-length,upload-expires,upload-length,upload-metadata,upload-offset,x-http-method-override,x-request-id,x-requested-with | + | Access-Control-Allow-Headers | Authorization,Origin,X-Requested-With,X-Request-Id,X-HTTP-Method-Override,Content-Type,Upload-Length,Upload-Offset,Tus-Resumable,Upload-Metadata,Upload-Defer-Length,Upload-Concat,Upload-Complete,Upload-Incomplete,Upload-Draft-Interop-Version | | Access-Control-Allow-Origin | https://aphno.badal | | Access-Control-Allow-Methods | | Examples: