diff --git a/swift/proxy/controllers/base.py b/swift/proxy/controllers/base.py index 56cc9090f2..23893b17e1 100644 --- a/swift/proxy/controllers/base.py +++ b/swift/proxy/controllers/base.py @@ -456,6 +456,9 @@ def _prepare_pre_auth_info_request(env, path, swift_source): # Set the env for the pre_authed call without a query string newenv = make_pre_authed_env(env, 'HEAD', path, agent='Swift', query_string='', swift_source=swift_source) + # This is a sub request for container metadata- drop the Origin header from + # the request so the it is not treated as a CORS request. + newenv.pop('HTTP_ORIGIN', None) # Note that Request.blank expects quoted path return Request.blank(quote(path), environ=newenv) diff --git a/test/unit/proxy/test_server.py b/test/unit/proxy/test_server.py index ec786aa800..497100c115 100644 --- a/test/unit/proxy/test_server.py +++ b/test/unit/proxy/test_server.py @@ -49,6 +49,7 @@ from swift.common import utils from swift.common.utils import mkdirs, normalize_timestamp, NullLogger from swift.common.wsgi import monkey_patch_mimetools from swift.proxy.controllers.obj import SegmentedIterable +from swift.proxy.controllers import base as proxy_base from swift.proxy.controllers.base import get_container_memcache_key, \ get_account_memcache_key, cors_validation import swift.proxy.controllers @@ -5093,6 +5094,33 @@ class TestContainerController(unittest.TestCase): controller.HEAD(req) self.assert_(called[0]) + def test_OPTIONS_get_info_drops_origin(self): + with save_globals(): + controller = proxy_server.ContainerController(self.app, 'a', 'c') + + count = [0] + + def my_get_info(app, env, account, container=None, + ret_not_found=False, swift_source=None): + if count[0] > 11: + return {} + count[0] += 1 + if not container: + return {'some': 'stuff'} + return proxy_base.was_get_info( + app, env, account, container, ret_not_found, swift_source) + + proxy_base.was_get_info = proxy_base.get_info + with mock.patch.object(proxy_base, 'get_info', my_get_info): + proxy_base.get_info = my_get_info + req = Request.blank( + '/v1/a/c', + {'REQUEST_METHOD': 'OPTIONS'}, + headers={'Origin': 'http://foo.com', + 'Access-Control-Request-Method': 'GET'}) + controller.OPTIONS(req) + self.assertTrue(count[0] < 11) + def test_OPTIONS(self): with save_globals(): controller = proxy_server.ContainerController(self.app, 'a', 'c')