mirror of
https://github.com/rclone/rclone.git
synced 2026-10-28 14:28:38 -04:00
Nick Craig-Wood
25707f2dc6
Before this change the basic, htpasswd and auth proxy authentication middlewares let every OPTIONS request through without checking credentials so that browser CORS preflights, which can't carry credentials, would succeed. However in serve webdav the OPTIONS request is answered by the WebDAV handler whose Allow header depends on whether the path is an existing file, an existing directory or doesn't exist, so an unauthenticated client could discover the existence and type of any path on the served remote even with --user/--pass or --htpasswd set. After this change he authentication middlewares no longer special-case OPTIONS. Instead the CORS middleware, which runs before authentication and owns the --allow-origin setting, answers genuine CORS preflights itself with an empty 200 carrying the CORS headers only when --allow-origin is set. All other OPTIONS requests need credentials like any other method, so clients which probe with OPTIONS before authenticating will get a 401 challenge and must retry with credentials.