snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/s3api/cors/cors.go

@@ -0,0 +1,385 @@
+package cors
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+)
+
+// CORSRule represents a single CORS rule
+type CORSRule struct {
+	AllowedHeaders []string `xml:"AllowedHeader,omitempty" json:"AllowedHeaders,omitempty"`
+	AllowedMethods []string `xml:"AllowedMethod" json:"AllowedMethods"`
+	AllowedOrigins []string `xml:"AllowedOrigin" json:"AllowedOrigins"`
+	ExposeHeaders  []string `xml:"ExposeHeader,omitempty" json:"ExposeHeaders,omitempty"`
+	MaxAgeSeconds  *int     `xml:"MaxAgeSeconds,omitempty" json:"MaxAgeSeconds,omitempty"`
+	ID             string   `xml:"ID,omitempty" json:"ID,omitempty"`
+}
+
+// CORSConfiguration represents the CORS configuration for a bucket
+type CORSConfiguration struct {
+	CORSRules []CORSRule `xml:"CORSRule" json:"CORSRules"`
+}
+
+// CORSRequest represents a CORS request
+type CORSRequest struct {
+	Origin                      string
+	Method                      string
+	RequestHeaders              []string
+	IsPreflightRequest          bool
+	AccessControlRequestMethod  string
+	AccessControlRequestHeaders []string
+}
+
+// CORSResponse represents the response for a CORS request
+type CORSResponse struct {
+	AllowOrigin      string
+	AllowMethods     string
+	AllowHeaders     string
+	ExposeHeaders    string
+	MaxAge           string
+	AllowCredentials bool
+}
+
+// ValidateConfiguration validates a CORS configuration
+func ValidateConfiguration(config *CORSConfiguration) error {
+	if config == nil {
+		return fmt.Errorf("CORS configuration cannot be nil")
+	}
+
+	if len(config.CORSRules) == 0 {
+		return fmt.Errorf("CORS configuration must have at least one rule")
+	}
+
+	if len(config.CORSRules) > 100 {
+		return fmt.Errorf("CORS configuration cannot have more than 100 rules")
+	}
+
+	for i, rule := range config.CORSRules {
+		if err := validateRule(&rule); err != nil {
+			return fmt.Errorf("invalid CORS rule at index %d: %v", i, err)
+		}
+	}
+
+	return nil
+}
+
+// ParseRequest parses an HTTP request to extract CORS information
+func ParseRequest(r *http.Request) *CORSRequest {
+	corsReq := &CORSRequest{
+		Origin: r.Header.Get("Origin"),
+		Method: r.Method,
+	}
+
+	// Check if this is a preflight request
+	if r.Method == "OPTIONS" {
+		corsReq.IsPreflightRequest = true
+		corsReq.AccessControlRequestMethod = r.Header.Get("Access-Control-Request-Method")
+
+		if headers := r.Header.Get("Access-Control-Request-Headers"); headers != "" {
+			corsReq.AccessControlRequestHeaders = strings.Split(headers, ",")
+			for i := range corsReq.AccessControlRequestHeaders {
+				corsReq.AccessControlRequestHeaders[i] = strings.TrimSpace(corsReq.AccessControlRequestHeaders[i])
+			}
+		}
+	}
+
+	return corsReq
+}
+
+// validateRule validates a single CORS rule
+func validateRule(rule *CORSRule) error {
+	if len(rule.AllowedMethods) == 0 {
+		return fmt.Errorf("AllowedMethods cannot be empty")
+	}
+
+	if len(rule.AllowedOrigins) == 0 {
+		return fmt.Errorf("AllowedOrigins cannot be empty")
+	}
+
+	// Validate allowed methods
+	validMethods := map[string]bool{
+		"GET":    true,
+		"PUT":    true,
+		"POST":   true,
+		"DELETE": true,
+		"HEAD":   true,
+	}
+
+	for _, method := range rule.AllowedMethods {
+		if !validMethods[method] {
+			return fmt.Errorf("invalid HTTP method: %s", method)
+		}
+	}
+
+	// Validate origins
+	for _, origin := range rule.AllowedOrigins {
+		if origin == "*" {
+			continue
+		}
+		if err := validateOrigin(origin); err != nil {
+			return fmt.Errorf("invalid origin %s: %v", origin, err)
+		}
+	}
+
+	// Validate MaxAgeSeconds
+	if rule.MaxAgeSeconds != nil && *rule.MaxAgeSeconds < 0 {
+		return fmt.Errorf("MaxAgeSeconds cannot be negative")
+	}
+
+	return nil
+}
+
+// validateOrigin validates an origin string
+func validateOrigin(origin string) error {
+	if origin == "" {
+		return fmt.Errorf("origin cannot be empty")
+	}
+
+	// Special case: "*" is always valid
+	if origin == "*" {
+		return nil
+	}
+
+	// Count wildcards
+	wildcardCount := strings.Count(origin, "*")
+	if wildcardCount > 1 {
+		return fmt.Errorf("origin can contain at most one wildcard")
+	}
+
+	// If there's a wildcard, it should be in a valid position
+	if wildcardCount == 1 {
+		// Must be in the format: http://*.example.com or https://*.example.com
+		if !strings.HasPrefix(origin, "http://") && !strings.HasPrefix(origin, "https://") {
+			return fmt.Errorf("origin with wildcard must start with http:// or https://")
+		}
+	}
+
+	return nil
+}
+
+// EvaluateRequest evaluates a CORS request against a CORS configuration
+func EvaluateRequest(config *CORSConfiguration, corsReq *CORSRequest) (*CORSResponse, error) {
+	if config == nil || corsReq == nil {
+		return nil, fmt.Errorf("config and corsReq cannot be nil")
+	}
+
+	if corsReq.Origin == "" {
+		return nil, fmt.Errorf("origin header is required for CORS requests")
+	}
+
+	// Find the first rule that matches the origin
+	for _, rule := range config.CORSRules {
+		if matchesOrigin(rule.AllowedOrigins, corsReq.Origin) {
+			// For preflight requests, we need more detailed validation
+			if corsReq.IsPreflightRequest {
+				return buildPreflightResponse(&rule, corsReq), nil
+			} else {
+				// For actual requests, check method
+				if containsString(rule.AllowedMethods, corsReq.Method) {
+					return buildResponse(&rule, corsReq), nil
+				}
+			}
+		}
+	}
+
+	return nil, fmt.Errorf("no matching CORS rule found")
+}
+
+// buildPreflightResponse builds a CORS response for preflight requests
+func buildPreflightResponse(rule *CORSRule, corsReq *CORSRequest) *CORSResponse {
+	response := &CORSResponse{
+		AllowOrigin: corsReq.Origin,
+	}
+
+	// Check if the requested method is allowed
+	methodAllowed := corsReq.AccessControlRequestMethod == "" || containsString(rule.AllowedMethods, corsReq.AccessControlRequestMethod)
+
+	// Check requested headers
+	var allowedRequestHeaders []string
+	allHeadersAllowed := true
+
+	if len(corsReq.AccessControlRequestHeaders) > 0 {
+		// Check if wildcard is allowed
+		hasWildcard := false
+		for _, header := range rule.AllowedHeaders {
+			if header == "*" {
+				hasWildcard = true
+				break
+			}
+		}
+
+		if hasWildcard {
+			// All requested headers are allowed with wildcard
+			allowedRequestHeaders = corsReq.AccessControlRequestHeaders
+		} else {
+			// Check each requested header individually
+			for _, requestedHeader := range corsReq.AccessControlRequestHeaders {
+				if matchesHeader(rule.AllowedHeaders, requestedHeader) {
+					allowedRequestHeaders = append(allowedRequestHeaders, requestedHeader)
+				} else {
+					allHeadersAllowed = false
+				}
+			}
+		}
+	}
+
+	// Only set method and header info if both method and ALL headers are allowed
+	if methodAllowed && allHeadersAllowed {
+		response.AllowMethods = strings.Join(rule.AllowedMethods, ", ")
+
+		if len(allowedRequestHeaders) > 0 {
+			response.AllowHeaders = strings.Join(allowedRequestHeaders, ", ")
+		}
+
+		// Set exposed headers
+		if len(rule.ExposeHeaders) > 0 {
+			response.ExposeHeaders = strings.Join(rule.ExposeHeaders, ", ")
+		}
+
+		// Set max age
+		if rule.MaxAgeSeconds != nil {
+			response.MaxAge = strconv.Itoa(*rule.MaxAgeSeconds)
+		}
+	}
+
+	return response
+}
+
+// buildResponse builds a CORS response from a matching rule
+func buildResponse(rule *CORSRule, corsReq *CORSRequest) *CORSResponse {
+	response := &CORSResponse{
+		AllowOrigin: corsReq.Origin,
+	}
+
+	// Set allowed methods
+	response.AllowMethods = strings.Join(rule.AllowedMethods, ", ")
+
+	// Set allowed headers
+	if len(rule.AllowedHeaders) > 0 {
+		response.AllowHeaders = strings.Join(rule.AllowedHeaders, ", ")
+	}
+
+	// Set expose headers
+	if len(rule.ExposeHeaders) > 0 {
+		response.ExposeHeaders = strings.Join(rule.ExposeHeaders, ", ")
+	}
+
+	// Set max age
+	if rule.MaxAgeSeconds != nil {
+		response.MaxAge = strconv.Itoa(*rule.MaxAgeSeconds)
+	}
+
+	return response
+}
+
+// Helper functions
+
+// matchesOrigin checks if the request origin matches any allowed origin
+func matchesOrigin(allowedOrigins []string, origin string) bool {
+	for _, allowedOrigin := range allowedOrigins {
+		if allowedOrigin == "*" {
+			return true
+		}
+		if allowedOrigin == origin {
+			return true
+		}
+		// Handle wildcard patterns like https://*.example.com
+		if strings.Contains(allowedOrigin, "*") {
+			if matchWildcard(allowedOrigin, origin) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// matchWildcard performs wildcard matching for origins
+func matchWildcard(pattern, text string) bool {
+	// Simple wildcard matching - only supports single * at the beginning
+	if strings.HasPrefix(pattern, "http://*") {
+		suffix := pattern[8:] // Remove "http://*"
+		return strings.HasPrefix(text, "http://") && strings.HasSuffix(text, suffix)
+	}
+	if strings.HasPrefix(pattern, "https://*") {
+		suffix := pattern[9:] // Remove "https://*"
+		return strings.HasPrefix(text, "https://") && strings.HasSuffix(text, suffix)
+	}
+	return false
+}
+
+// matchesHeader checks if a header is allowed
+func matchesHeader(allowedHeaders []string, header string) bool {
+	// If no headers are specified, all headers are allowed
+	if len(allowedHeaders) == 0 {
+		return true
+	}
+
+	// Header matching is case-insensitive
+	header = strings.ToLower(header)
+
+	for _, allowedHeader := range allowedHeaders {
+		allowedHeaderLower := strings.ToLower(allowedHeader)
+
+		// Wildcard match
+		if allowedHeaderLower == "*" {
+			return true
+		}
+
+		// Exact match
+		if allowedHeaderLower == header {
+			return true
+		}
+
+		// Prefix wildcard match (e.g., "x-amz-*" matches "x-amz-date")
+		if strings.HasSuffix(allowedHeaderLower, "*") {
+			prefix := strings.TrimSuffix(allowedHeaderLower, "*")
+			if strings.HasPrefix(header, prefix) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// containsString checks if a slice contains a specific string
+func containsString(slice []string, item string) bool {
+	for _, s := range slice {
+		if s == item {
+			return true
+		}
+	}
+	return false
+}
+
+// ApplyHeaders applies CORS headers to an HTTP response
+func ApplyHeaders(w http.ResponseWriter, corsResp *CORSResponse) {
+	if corsResp == nil {
+		return
+	}
+
+	if corsResp.AllowOrigin != "" {
+		w.Header().Set("Access-Control-Allow-Origin", corsResp.AllowOrigin)
+	}
+
+	if corsResp.AllowMethods != "" {
+		w.Header().Set("Access-Control-Allow-Methods", corsResp.AllowMethods)
+	}
+
+	if corsResp.AllowHeaders != "" {
+		w.Header().Set("Access-Control-Allow-Headers", corsResp.AllowHeaders)
+	}
+
+	if corsResp.ExposeHeaders != "" {
+		w.Header().Set("Access-Control-Expose-Headers", corsResp.ExposeHeaders)
+	}
+
+	if corsResp.MaxAge != "" {
+		w.Header().Set("Access-Control-Max-Age", corsResp.MaxAge)
+	}
+
+	if corsResp.AllowCredentials {
+		w.Header().Set("Access-Control-Allow-Credentials", "true")
+	}
+}

weed/s3api/cors/cors_test.go

@@ -0,0 +1,569 @@
+package cors
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"reflect"
+	"testing"
+)
+
+func TestValidateConfiguration(t *testing.T) {
+	tests := []struct {
+		name    string
+		config  *CORSConfiguration
+		wantErr bool
+	}{
+		{
+			name:    "nil config",
+			config:  nil,
+			wantErr: true,
+		},
+		{
+			name: "empty rules",
+			config: &CORSConfiguration{
+				CORSRules: []CORSRule{},
+			},
+			wantErr: true,
+		},
+		{
+			name: "valid single rule",
+			config: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedMethods: []string{"GET", "POST"},
+						AllowedOrigins: []string{"*"},
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "too many rules",
+			config: &CORSConfiguration{
+				CORSRules: make([]CORSRule, 101),
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid method",
+			config: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedMethods: []string{"INVALID"},
+						AllowedOrigins: []string{"*"},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "empty origins",
+			config: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedMethods: []string{"GET"},
+						AllowedOrigins: []string{},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid origin with multiple wildcards",
+			config: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedMethods: []string{"GET"},
+						AllowedOrigins: []string{"http://*.*.example.com"},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "negative MaxAgeSeconds",
+			config: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedMethods: []string{"GET"},
+						AllowedOrigins: []string{"*"},
+						MaxAgeSeconds:  intPtr(-1),
+					},
+				},
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidateConfiguration(tt.config)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("ValidateConfiguration() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestValidateOrigin(t *testing.T) {
+	tests := []struct {
+		name    string
+		origin  string
+		wantErr bool
+	}{
+		{
+			name:    "empty origin",
+			origin:  "",
+			wantErr: true,
+		},
+		{
+			name:    "valid origin",
+			origin:  "http://example.com",
+			wantErr: false,
+		},
+		{
+			name:    "wildcard origin",
+			origin:  "*",
+			wantErr: false,
+		},
+		{
+			name:    "valid wildcard origin",
+			origin:  "http://*.example.com",
+			wantErr: false,
+		},
+		{
+			name:    "https wildcard origin",
+			origin:  "https://*.example.com",
+			wantErr: false,
+		},
+		{
+			name:    "invalid wildcard origin",
+			origin:  "*.example.com",
+			wantErr: true,
+		},
+		{
+			name:    "multiple wildcards",
+			origin:  "http://*.*.example.com",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateOrigin(tt.origin)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("validateOrigin() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestParseRequest(t *testing.T) {
+	tests := []struct {
+		name string
+		req  *http.Request
+		want *CORSRequest
+	}{
+		{
+			name: "simple GET request",
+			req: &http.Request{
+				Method: "GET",
+				Header: http.Header{
+					"Origin": []string{"http://example.com"},
+				},
+			},
+			want: &CORSRequest{
+				Origin:             "http://example.com",
+				Method:             "GET",
+				IsPreflightRequest: false,
+			},
+		},
+		{
+			name: "OPTIONS preflight request",
+			req: &http.Request{
+				Method: "OPTIONS",
+				Header: http.Header{
+					"Origin":                         []string{"http://example.com"},
+					"Access-Control-Request-Method":  []string{"PUT"},
+					"Access-Control-Request-Headers": []string{"Content-Type, Authorization"},
+				},
+			},
+			want: &CORSRequest{
+				Origin:                      "http://example.com",
+				Method:                      "OPTIONS",
+				IsPreflightRequest:          true,
+				AccessControlRequestMethod:  "PUT",
+				AccessControlRequestHeaders: []string{"Content-Type", "Authorization"},
+			},
+		},
+		{
+			name: "request without origin",
+			req: &http.Request{
+				Method: "GET",
+				Header: http.Header{},
+			},
+			want: &CORSRequest{
+				Origin:             "",
+				Method:             "GET",
+				IsPreflightRequest: false,
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := ParseRequest(tt.req)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("ParseRequest() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestMatchesOrigin(t *testing.T) {
+	tests := []struct {
+		name           string
+		allowedOrigins []string
+		origin         string
+		want           bool
+	}{
+		{
+			name:           "wildcard match",
+			allowedOrigins: []string{"*"},
+			origin:         "http://example.com",
+			want:           true,
+		},
+		{
+			name:           "exact match",
+			allowedOrigins: []string{"http://example.com"},
+			origin:         "http://example.com",
+			want:           true,
+		},
+		{
+			name:           "no match",
+			allowedOrigins: []string{"http://example.com"},
+			origin:         "http://other.com",
+			want:           false,
+		},
+		{
+			name:           "wildcard subdomain match",
+			allowedOrigins: []string{"http://*.example.com"},
+			origin:         "http://api.example.com",
+			want:           true,
+		},
+		{
+			name:           "wildcard subdomain no match",
+			allowedOrigins: []string{"http://*.example.com"},
+			origin:         "http://example.com",
+			want:           false,
+		},
+		{
+			name:           "multiple origins with match",
+			allowedOrigins: []string{"http://example.com", "http://other.com"},
+			origin:         "http://other.com",
+			want:           true,
+		},
+		// HTTPS test cases
+		{
+			name:           "https exact match",
+			allowedOrigins: []string{"https://example.com"},
+			origin:         "https://example.com",
+			want:           true,
+		},
+		{
+			name:           "https no match",
+			allowedOrigins: []string{"https://example.com"},
+			origin:         "https://other.com",
+			want:           false,
+		},
+		{
+			name:           "https wildcard subdomain match",
+			allowedOrigins: []string{"https://*.example.com"},
+			origin:         "https://api.example.com",
+			want:           true,
+		},
+		{
+			name:           "https wildcard subdomain no match - base domain",
+			allowedOrigins: []string{"https://*.example.com"},
+			origin:         "https://example.com",
+			want:           false,
+		},
+		{
+			name:           "https wildcard subdomain no match - different domain",
+			allowedOrigins: []string{"https://*.example.com"},
+			origin:         "https://api.other.com",
+			want:           false,
+		},
+		{
+			name:           "protocol mismatch - http pattern https origin",
+			allowedOrigins: []string{"http://*.example.com"},
+			origin:         "https://api.example.com",
+			want:           false,
+		},
+		{
+			name:           "protocol mismatch - https pattern http origin",
+			allowedOrigins: []string{"https://*.example.com"},
+			origin:         "http://api.example.com",
+			want:           false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := matchesOrigin(tt.allowedOrigins, tt.origin)
+			if got != tt.want {
+				t.Errorf("matchesOrigin() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestMatchesHeader(t *testing.T) {
+	tests := []struct {
+		name           string
+		allowedHeaders []string
+		header         string
+		want           bool
+	}{
+		{
+			name:           "empty allowed headers",
+			allowedHeaders: []string{},
+			header:         "Content-Type",
+			want:           true,
+		},
+		{
+			name:           "wildcard match",
+			allowedHeaders: []string{"*"},
+			header:         "Content-Type",
+			want:           true,
+		},
+		{
+			name:           "exact match",
+			allowedHeaders: []string{"Content-Type"},
+			header:         "Content-Type",
+			want:           true,
+		},
+		{
+			name:           "case insensitive match",
+			allowedHeaders: []string{"content-type"},
+			header:         "Content-Type",
+			want:           true,
+		},
+		{
+			name:           "no match",
+			allowedHeaders: []string{"Authorization"},
+			header:         "Content-Type",
+			want:           false,
+		},
+		{
+			name:           "wildcard prefix match",
+			allowedHeaders: []string{"x-amz-*"},
+			header:         "x-amz-date",
+			want:           true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := matchesHeader(tt.allowedHeaders, tt.header)
+			if got != tt.want {
+				t.Errorf("matchesHeader() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestEvaluateRequest(t *testing.T) {
+	config := &CORSConfiguration{
+		CORSRules: []CORSRule{
+			{
+				AllowedMethods: []string{"GET", "POST"},
+				AllowedOrigins: []string{"http://example.com"},
+				AllowedHeaders: []string{"Content-Type"},
+				ExposeHeaders:  []string{"ETag"},
+				MaxAgeSeconds:  intPtr(3600),
+			},
+			{
+				AllowedMethods: []string{"PUT"},
+				AllowedOrigins: []string{"*"},
+			},
+		},
+	}
+
+	tests := []struct {
+		name    string
+		config  *CORSConfiguration
+		corsReq *CORSRequest
+		want    *CORSResponse
+		wantErr bool
+	}{
+		{
+			name:   "matching first rule",
+			config: config,
+			corsReq: &CORSRequest{
+				Origin: "http://example.com",
+				Method: "GET",
+			},
+			want: &CORSResponse{
+				AllowOrigin:   "http://example.com",
+				AllowMethods:  "GET, POST",
+				AllowHeaders:  "Content-Type",
+				ExposeHeaders: "ETag",
+				MaxAge:        "3600",
+			},
+			wantErr: false,
+		},
+		{
+			name:   "matching second rule",
+			config: config,
+			corsReq: &CORSRequest{
+				Origin: "http://other.com",
+				Method: "PUT",
+			},
+			want: &CORSResponse{
+				AllowOrigin:  "http://other.com",
+				AllowMethods: "PUT",
+			},
+			wantErr: false,
+		},
+		{
+			name:   "no matching rule",
+			config: config,
+			corsReq: &CORSRequest{
+				Origin: "http://forbidden.com",
+				Method: "GET",
+			},
+			want:    nil,
+			wantErr: true,
+		},
+		{
+			name:   "preflight request",
+			config: config,
+			corsReq: &CORSRequest{
+				Origin:                      "http://example.com",
+				Method:                      "OPTIONS",
+				IsPreflightRequest:          true,
+				AccessControlRequestMethod:  "POST",
+				AccessControlRequestHeaders: []string{"Content-Type"},
+			},
+			want: &CORSResponse{
+				AllowOrigin:   "http://example.com",
+				AllowMethods:  "GET, POST",
+				AllowHeaders:  "Content-Type",
+				ExposeHeaders: "ETag",
+				MaxAge:        "3600",
+			},
+			wantErr: false,
+		},
+		{
+			name:   "preflight request with forbidden header",
+			config: config,
+			corsReq: &CORSRequest{
+				Origin:                      "http://example.com",
+				Method:                      "OPTIONS",
+				IsPreflightRequest:          true,
+				AccessControlRequestMethod:  "POST",
+				AccessControlRequestHeaders: []string{"Authorization"},
+			},
+			want: &CORSResponse{
+				AllowOrigin: "http://example.com",
+				// No AllowMethods or AllowHeaders because the requested header is forbidden
+			},
+			wantErr: false,
+		},
+		{
+			name:   "request without origin",
+			config: config,
+			corsReq: &CORSRequest{
+				Origin: "",
+				Method: "GET",
+			},
+			want:    nil,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := EvaluateRequest(tt.config, tt.corsReq)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("EvaluateRequest() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("EvaluateRequest() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestApplyHeaders(t *testing.T) {
+	tests := []struct {
+		name     string
+		corsResp *CORSResponse
+		want     map[string]string
+	}{
+		{
+			name:     "nil response",
+			corsResp: nil,
+			want:     map[string]string{},
+		},
+		{
+			name: "complete response",
+			corsResp: &CORSResponse{
+				AllowOrigin:   "http://example.com",
+				AllowMethods:  "GET, POST",
+				AllowHeaders:  "Content-Type",
+				ExposeHeaders: "ETag",
+				MaxAge:        "3600",
+			},
+			want: map[string]string{
+				"Access-Control-Allow-Origin":   "http://example.com",
+				"Access-Control-Allow-Methods":  "GET, POST",
+				"Access-Control-Allow-Headers":  "Content-Type",
+				"Access-Control-Expose-Headers": "ETag",
+				"Access-Control-Max-Age":        "3600",
+			},
+		},
+		{
+			name: "with credentials",
+			corsResp: &CORSResponse{
+				AllowOrigin:      "http://example.com",
+				AllowMethods:     "GET",
+				AllowCredentials: true,
+			},
+			want: map[string]string{
+				"Access-Control-Allow-Origin":      "http://example.com",
+				"Access-Control-Allow-Methods":     "GET",
+				"Access-Control-Allow-Credentials": "true",
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create a proper response writer using httptest
+			w := httptest.NewRecorder()
+
+			ApplyHeaders(w, tt.corsResp)
+
+			// Extract headers from the response
+			headers := make(map[string]string)
+			for key, values := range w.Header() {
+				if len(values) > 0 {
+					headers[key] = values[0]
+				}
+			}
+
+			if !reflect.DeepEqual(headers, tt.want) {
+				t.Errorf("ApplyHeaders() headers = %v, want %v", headers, tt.want)
+			}
+		})
+	}
+}
+
+// Helper functions and types for testing
+
+func intPtr(i int) *int {
+	return &i
+}

weed/s3api/cors/middleware.go

@@ -0,0 +1,142 @@
+package cors
+
+import (
+	"net/http"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// BucketChecker interface for checking bucket existence
+type BucketChecker interface {
+	CheckBucket(r *http.Request, bucket string) s3err.ErrorCode
+}
+
+// CORSConfigGetter interface for getting CORS configuration
+type CORSConfigGetter interface {
+	GetCORSConfiguration(bucket string) (*CORSConfiguration, s3err.ErrorCode)
+}
+
+// Middleware handles CORS evaluation for all S3 API requests
+type Middleware struct {
+	bucketChecker    BucketChecker
+	corsConfigGetter CORSConfigGetter
+	fallbackConfig   *CORSConfiguration // Global CORS configuration as fallback
+}
+
+// NewMiddleware creates a new CORS middleware instance with optional global fallback config
+func NewMiddleware(bucketChecker BucketChecker, corsConfigGetter CORSConfigGetter, fallbackConfig *CORSConfiguration) *Middleware {
+	return &Middleware{
+		bucketChecker:    bucketChecker,
+		corsConfigGetter: corsConfigGetter,
+		fallbackConfig:   fallbackConfig,
+	}
+}
+
+// getCORSConfig retrieves the applicable CORS configuration, trying bucket-specific first, then fallback.
+// Returns the configuration and a boolean indicating if any configuration was found.
+// Only falls back to global config when there's explicitly no bucket-level config.
+// For other errors (e.g., access denied), returns false to let the handler deny the request.
+func (m *Middleware) getCORSConfig(bucket string) (*CORSConfiguration, bool) {
+	config, errCode := m.corsConfigGetter.GetCORSConfiguration(bucket)
+
+	switch errCode {
+	case s3err.ErrNone:
+		if config != nil {
+			// Found a bucket-specific config, use it.
+			return config, true
+		}
+		// No bucket config, proceed to fallback.
+	case s3err.ErrNoSuchCORSConfiguration:
+		// No bucket config, proceed to fallback.
+	case s3err.ErrNoSuchBucket:
+		// Bucket doesn't exist, proceed to fallback.
+		// This ensures we don't leak existence information by returning 403 vs 200.
+	default:
+		// Any other error means we should not proceed.
+		return nil, false
+	}
+
+	// No bucket-level config found, try global fallback
+	if m.fallbackConfig != nil {
+		return m.fallbackConfig, true
+	}
+
+	return nil, false
+}
+
+// Handler returns the CORS middleware handler
+func (m *Middleware) Handler(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		m.processCORS(w, r, func() {
+			next.ServeHTTP(w, r)
+		})
+	})
+}
+
+// HandleOptionsRequest handles OPTIONS requests for CORS preflight
+func (m *Middleware) HandleOptionsRequest(w http.ResponseWriter, r *http.Request) {
+	m.processCORS(w, r, func() {
+		w.WriteHeader(http.StatusOK)
+	})
+}
+
+// processCORS handles the common CORS logic for both regular and preflight requests.
+// It takes a next callback which is executed if the request flow proceeds (i.e., not short-circuited by CORS errors or preflight responses).
+func (m *Middleware) processCORS(w http.ResponseWriter, r *http.Request, next func()) {
+	corsReq := ParseRequest(r)
+	bucket, _ := s3_constants.GetBucketAndObject(r)
+
+	// 1. Basic Validation
+	if bucket == "" {
+		next()
+		return
+	}
+
+	// 2. Load Configuration
+	config, hasConfig := m.getCORSConfig(bucket)
+
+	// 3. Apply Vary Header (Always applied if config exists)
+	if hasConfig {
+		w.Header().Add("Vary", "Origin")
+	}
+
+	// 4. Handle Non-CORS Requests
+	if corsReq.Origin == "" {
+		next()
+		return
+	}
+
+	// 5. Handle Missing Configuration
+	if !hasConfig {
+		if corsReq.IsPreflightRequest {
+			s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
+			return
+		}
+		next()
+		return
+	}
+
+	// 6. Evaluate CORS Request
+	corsResp, err := EvaluateRequest(config, corsReq)
+	if err != nil {
+		glog.V(3).Infof("CORS evaluation failed for bucket %s: %v", bucket, err)
+		if corsReq.IsPreflightRequest {
+			s3err.WriteErrorResponse(w, r, s3err.ErrAccessDenied)
+			return
+		}
+		next()
+		return
+	}
+
+	// 7. Success Case
+	ApplyHeaders(w, corsResp)
+
+	if corsReq.IsPreflightRequest {
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+
+	next()
+}

weed/s3api/cors/middleware_nonexistent_bucket_test.go

@@ -0,0 +1,240 @@
+package cors
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// TestMiddlewareNonExistentBucket tests that CORS headers are applied even for non-existent buckets
+// This prevents information disclosure about bucket existence and ensures consistent CORS behavior
+func TestMiddlewareNonExistentBucket(t *testing.T) {
+	tests := []struct {
+		name                 string
+		fallbackConfig       *CORSConfiguration
+		requestOrigin        string
+		requestMethod        string
+		isOptions            bool
+		expectedStatus       int
+		expectedOriginHeader string
+		description          string
+	}{
+		{
+			name: "Preflight request to non-existent bucket with global CORS config",
+			fallbackConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"*"},
+						AllowedMethods: []string{"GET", "POST", "PUT", "DELETE", "HEAD"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			requestOrigin:        "https://example.com",
+			requestMethod:        "OPTIONS",
+			isOptions:            true,
+			expectedStatus:       http.StatusOK,
+			expectedOriginHeader: "https://example.com",
+			description:          "Preflight to non-existent bucket should succeed with CORS headers",
+		},
+		{
+			name: "Actual request to non-existent bucket with global CORS config",
+			fallbackConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"*"},
+						AllowedMethods: []string{"GET", "POST", "PUT", "DELETE", "HEAD"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			requestOrigin:        "https://example.com",
+			requestMethod:        "GET",
+			isOptions:            false,
+			expectedStatus:       http.StatusNotFound, // Handler returns NoSuchBucket
+			expectedOriginHeader: "https://example.com",
+			description:          "GET to non-existent bucket should have CORS headers even with NoSuchBucket error",
+		},
+		{
+			name: "Preflight to non-existent bucket with specific origin",
+			fallbackConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"https://allowed.com"},
+						AllowedMethods: []string{"GET", "POST"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			requestOrigin:        "https://allowed.com",
+			requestMethod:        "OPTIONS",
+			isOptions:            true,
+			expectedStatus:       http.StatusOK,
+			expectedOriginHeader: "https://allowed.com",
+			description:          "Preflight to non-existent bucket with matching origin should succeed",
+		},
+		{
+			name: "Preflight to non-existent bucket with non-matching origin",
+			fallbackConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"https://allowed.com"},
+						AllowedMethods: []string{"GET", "POST"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			requestOrigin:        "https://notallowed.com",
+			requestMethod:        "OPTIONS",
+			isOptions:            true,
+			expectedStatus:       http.StatusForbidden,
+			expectedOriginHeader: "",
+			description:          "Preflight to non-existent bucket with non-matching origin should fail",
+		},
+		{
+			name:                 "Preflight to non-existent bucket without CORS config",
+			fallbackConfig:       nil,
+			requestOrigin:        "https://example.com",
+			requestMethod:        "OPTIONS",
+			isOptions:            true,
+			expectedStatus:       http.StatusForbidden,
+			expectedOriginHeader: "",
+			description:          "Preflight to non-existent bucket without CORS config should fail",
+		},
+		{
+			name: "Bucket listing request to non-existent bucket with CORS",
+			fallbackConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"*"},
+						AllowedMethods: []string{"GET", "POST", "PUT", "DELETE", "HEAD"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			requestOrigin:        "https://mydomain.com",
+			requestMethod:        "OPTIONS",
+			isOptions:            true,
+			expectedStatus:       http.StatusOK,
+			expectedOriginHeader: "https://mydomain.com",
+			description:          "Bucket listing preflight to non-existent bucket should have CORS headers (issue #8065)",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Setup mocks - bucket does NOT exist
+			bucketChecker := &mockBucketChecker{bucketExists: false}
+			configGetter := &mockCORSConfigGetter{
+				config:  nil, // No bucket-specific config
+				errCode: s3err.ErrNone,
+			}
+
+			// Create middleware with fallback config
+			middleware := NewMiddleware(bucketChecker, configGetter, tt.fallbackConfig)
+
+			// Create request with mux variables
+			req := httptest.NewRequest(tt.requestMethod, "/nonexistent-bucket/testobject", nil)
+			req = mux.SetURLVars(req, map[string]string{
+				"bucket": "nonexistent-bucket",
+				"object": "testobject",
+			})
+			if tt.requestOrigin != "" {
+				req.Header.Set("Origin", tt.requestOrigin)
+			}
+			if tt.isOptions {
+				req.Header.Set("Access-Control-Request-Method", "GET")
+			}
+
+			// Create response recorder
+			w := httptest.NewRecorder()
+
+			// Create a handler that returns 404 for non-existent buckets
+			nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				// Simulate NoSuchBucket error
+				w.WriteHeader(http.StatusNotFound)
+			})
+
+			// Execute middleware
+			if tt.isOptions {
+				middleware.HandleOptionsRequest(w, req)
+			} else {
+				middleware.Handler(nextHandler).ServeHTTP(w, req)
+			}
+
+			// Check status code
+			if w.Code != tt.expectedStatus {
+				t.Errorf("%s: expected status %d, got %d", tt.description, tt.expectedStatus, w.Code)
+			}
+
+			// Check CORS header
+			actualOrigin := w.Header().Get("Access-Control-Allow-Origin")
+			if actualOrigin != tt.expectedOriginHeader {
+				t.Errorf("%s: expected Access-Control-Allow-Origin='%s', got '%s'",
+					tt.description, tt.expectedOriginHeader, actualOrigin)
+			}
+		})
+	}
+}
+
+// TestMiddlewareConsistentBehavior tests that CORS headers are consistent regardless of bucket existence
+// This is a security test to ensure bucket existence cannot be inferred from CORS header presence
+func TestMiddlewareConsistentBehavior(t *testing.T) {
+	fallbackConfig := &CORSConfiguration{
+		CORSRules: []CORSRule{
+			{
+				AllowedOrigins: []string{"*"},
+				AllowedMethods: []string{"GET", "POST", "PUT", "DELETE", "HEAD"},
+				AllowedHeaders: []string{"*"},
+			},
+		},
+	}
+
+	testCases := []struct {
+		bucketExists bool
+		description  string
+	}{
+		{bucketExists: true, description: "existing bucket"},
+		{bucketExists: false, description: "non-existent bucket"},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.description, func(t *testing.T) {
+			// Setup mocks
+			bucketChecker := &mockBucketChecker{bucketExists: tc.bucketExists}
+			configGetter := &mockCORSConfigGetter{
+				config:  nil,
+				errCode: s3err.ErrNone,
+			}
+
+			middleware := NewMiddleware(bucketChecker, configGetter, fallbackConfig)
+
+			// Create preflight request
+			req := httptest.NewRequest("OPTIONS", "/testbucket/testobject", nil)
+			req = mux.SetURLVars(req, map[string]string{
+				"bucket": "testbucket",
+				"object": "testobject",
+			})
+			req.Header.Set("Origin", "https://example.com")
+			req.Header.Set("Access-Control-Request-Method", "GET")
+
+			w := httptest.NewRecorder()
+			middleware.HandleOptionsRequest(w, req)
+
+			// Both existing and non-existent buckets should return same CORS headers
+			actualOrigin := w.Header().Get("Access-Control-Allow-Origin")
+			if actualOrigin != "https://example.com" {
+				t.Errorf("%s: expected Access-Control-Allow-Origin='https://example.com', got '%s'",
+					tc.description, actualOrigin)
+			}
+
+			// Both should return 200 OK for preflight
+			if w.Code != http.StatusOK {
+				t.Errorf("%s: expected status 200, got %d", tc.description, w.Code)
+			}
+		})
+	}
+}

weed/s3api/cors/middleware_test.go

@@ -0,0 +1,564 @@
+package cors
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+)
+
+// Mock implementations for testing
+
+type mockBucketChecker struct {
+	bucketExists bool
+}
+
+func (m *mockBucketChecker) CheckBucket(r *http.Request, bucket string) s3err.ErrorCode {
+	if m.bucketExists {
+		return s3err.ErrNone
+	}
+	return s3err.ErrNoSuchBucket
+}
+
+type mockCORSConfigGetter struct {
+	config  *CORSConfiguration
+	errCode s3err.ErrorCode
+}
+
+func (m *mockCORSConfigGetter) GetCORSConfiguration(bucket string) (*CORSConfiguration, s3err.ErrorCode) {
+	return m.config, m.errCode
+}
+
+// TestMiddlewareFallbackConfig tests that the middleware uses fallback config when bucket-level config is not available
+func TestMiddlewareFallbackConfig(t *testing.T) {
+	tests := []struct {
+		name                 string
+		bucketConfig         *CORSConfiguration
+		fallbackConfig       *CORSConfiguration
+		requestOrigin        string
+		requestMethod        string
+		isOptions            bool
+		expectedStatus       int
+		expectedOriginHeader string
+		description          string
+	}{
+		{
+			name:         "No bucket config, fallback to global config with wildcard",
+			bucketConfig: nil,
+			fallbackConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"*"},
+						AllowedMethods: []string{"GET", "POST", "PUT", "DELETE", "HEAD"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			requestOrigin:        "https://example.com",
+			requestMethod:        "GET",
+			isOptions:            false,
+			expectedStatus:       http.StatusOK,
+			expectedOriginHeader: "https://example.com",
+			description:          "Should use fallback global config when no bucket config exists",
+		},
+		{
+			name:         "No bucket config, fallback to global config with specific origin",
+			bucketConfig: nil,
+			fallbackConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"https://example.com"},
+						AllowedMethods: []string{"GET", "POST"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			requestOrigin:        "https://example.com",
+			requestMethod:        "GET",
+			isOptions:            false,
+			expectedStatus:       http.StatusOK,
+			expectedOriginHeader: "https://example.com",
+			description:          "Should use fallback config with specific origin match",
+		},
+		{
+			name:         "No bucket config, fallback rejects non-matching origin",
+			bucketConfig: nil,
+			fallbackConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"https://allowed.com"},
+						AllowedMethods: []string{"GET"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			requestOrigin:        "https://notallowed.com",
+			requestMethod:        "GET",
+			isOptions:            false,
+			expectedStatus:       http.StatusOK,
+			expectedOriginHeader: "",
+			description:          "Should not apply CORS headers when origin doesn't match fallback config",
+		},
+		{
+			name: "Bucket config takes precedence over fallback",
+			bucketConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"https://bucket-specific.com"},
+						AllowedMethods: []string{"GET"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			fallbackConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"*"},
+						AllowedMethods: []string{"GET", "POST"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			requestOrigin:        "https://bucket-specific.com",
+			requestMethod:        "GET",
+			isOptions:            false,
+			expectedStatus:       http.StatusOK,
+			expectedOriginHeader: "https://bucket-specific.com",
+			description:          "Bucket-level config should be used instead of fallback",
+		},
+		{
+			name: "Bucket config rejects, even though fallback would allow",
+			bucketConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"https://restricted.com"},
+						AllowedMethods: []string{"GET"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			fallbackConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"*"},
+						AllowedMethods: []string{"GET", "POST"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			requestOrigin:        "https://example.com",
+			requestMethod:        "GET",
+			isOptions:            false,
+			expectedStatus:       http.StatusOK,
+			expectedOriginHeader: "",
+			description:          "Bucket-level config is authoritative, fallback should not apply",
+		},
+		{
+			name:                 "No config at all, no CORS headers",
+			bucketConfig:         nil,
+			fallbackConfig:       nil,
+			requestOrigin:        "https://example.com",
+			requestMethod:        "GET",
+			isOptions:            false,
+			expectedStatus:       http.StatusOK,
+			expectedOriginHeader: "",
+			description:          "Without any config, no CORS headers should be applied",
+		},
+		{
+			name:         "OPTIONS preflight with fallback config",
+			bucketConfig: nil,
+			fallbackConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"https://example.com"},
+						AllowedMethods: []string{"GET", "POST"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			requestOrigin:        "https://example.com",
+			requestMethod:        "OPTIONS",
+			isOptions:            true,
+			expectedStatus:       http.StatusOK,
+			expectedOriginHeader: "https://example.com",
+			description:          "OPTIONS preflight should work with fallback config",
+		},
+		{
+			name:                 "OPTIONS preflight without any config should fail",
+			bucketConfig:         nil,
+			fallbackConfig:       nil,
+			requestOrigin:        "https://example.com",
+			requestMethod:        "OPTIONS",
+			isOptions:            true,
+			expectedStatus:       http.StatusForbidden,
+			expectedOriginHeader: "",
+			description:          "OPTIONS preflight without config should return 403",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Setup mocks
+			bucketChecker := &mockBucketChecker{bucketExists: true}
+			configGetter := &mockCORSConfigGetter{
+				config:  tt.bucketConfig,
+				errCode: s3err.ErrNone,
+			}
+
+			// Create middleware with optional fallback
+			middleware := NewMiddleware(bucketChecker, configGetter, tt.fallbackConfig)
+
+			// Create request with mux variables
+			req := httptest.NewRequest(tt.requestMethod, "/testbucket/testobject", nil)
+			req = mux.SetURLVars(req, map[string]string{
+				"bucket": "testbucket",
+				"object": "testobject",
+			})
+			if tt.requestOrigin != "" {
+				req.Header.Set("Origin", tt.requestOrigin)
+			}
+			if tt.isOptions {
+				req.Header.Set("Access-Control-Request-Method", "GET")
+			}
+
+			// Create response recorder
+			w := httptest.NewRecorder()
+
+			// Create a simple handler that returns 200 OK
+			nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+			})
+
+			// Execute middleware
+			if tt.isOptions {
+				middleware.HandleOptionsRequest(w, req)
+			} else {
+				middleware.Handler(nextHandler).ServeHTTP(w, req)
+			}
+
+			// Check status code
+			if w.Code != tt.expectedStatus {
+				t.Errorf("%s: expected status %d, got %d", tt.description, tt.expectedStatus, w.Code)
+			}
+
+			// Check CORS header
+			actualOrigin := w.Header().Get("Access-Control-Allow-Origin")
+			if actualOrigin != tt.expectedOriginHeader {
+				t.Errorf("%s: expected Access-Control-Allow-Origin='%s', got '%s'",
+					tt.description, tt.expectedOriginHeader, actualOrigin)
+			}
+		})
+	}
+}
+
+// TestMiddlewareFallbackConfigWithMultipleOrigins tests fallback with multiple allowed origins
+func TestMiddlewareFallbackConfigWithMultipleOrigins(t *testing.T) {
+	fallbackConfig := &CORSConfiguration{
+		CORSRules: []CORSRule{
+			{
+				AllowedOrigins: []string{"https://example1.com", "https://example2.com"},
+				AllowedMethods: []string{"GET", "POST"},
+				AllowedHeaders: []string{"*"},
+			},
+		},
+	}
+
+	bucketChecker := &mockBucketChecker{bucketExists: true}
+	configGetter := &mockCORSConfigGetter{
+		config:  nil, // No bucket config
+		errCode: s3err.ErrNone,
+	}
+
+	middleware := NewMiddleware(bucketChecker, configGetter, fallbackConfig)
+
+	tests := []struct {
+		origin      string
+		shouldMatch bool
+		description string
+	}{
+		{
+			origin:      "https://example1.com",
+			shouldMatch: true,
+			description: "First allowed origin should match",
+		},
+		{
+			origin:      "https://example2.com",
+			shouldMatch: true,
+			description: "Second allowed origin should match",
+		},
+		{
+			origin:      "https://example3.com",
+			shouldMatch: false,
+			description: "Non-allowed origin should not match",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.description, func(t *testing.T) {
+			req := httptest.NewRequest("GET", "/testbucket/testobject", nil)
+			req = mux.SetURLVars(req, map[string]string{
+				"bucket": "testbucket",
+				"object": "testobject",
+			})
+			req.Header.Set("Origin", tt.origin)
+
+			w := httptest.NewRecorder()
+			nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+			})
+
+			middleware.Handler(nextHandler).ServeHTTP(w, req)
+
+			actualOrigin := w.Header().Get("Access-Control-Allow-Origin")
+			if tt.shouldMatch {
+				if actualOrigin != tt.origin {
+					t.Errorf("%s: expected Access-Control-Allow-Origin='%s', got '%s'",
+						tt.description, tt.origin, actualOrigin)
+				}
+			} else {
+				if actualOrigin != "" {
+					t.Errorf("%s: expected no Access-Control-Allow-Origin header, got '%s'",
+						tt.description, actualOrigin)
+				}
+			}
+		})
+	}
+}
+
+// TestMiddlewareFallbackWithError tests that real errors (not "no config") don't trigger fallback
+func TestMiddlewareFallbackWithError(t *testing.T) {
+	fallbackConfig := &CORSConfiguration{
+		CORSRules: []CORSRule{
+			{
+				AllowedOrigins: []string{"*"},
+				AllowedMethods: []string{"GET", "POST"},
+				AllowedHeaders: []string{"*"},
+			},
+		},
+	}
+
+	tests := []struct {
+		name                 string
+		errCode              s3err.ErrorCode
+		expectedOriginHeader string
+		description          string
+	}{
+		{
+			name:                 "ErrAccessDenied should not trigger fallback",
+			errCode:              s3err.ErrAccessDenied,
+			expectedOriginHeader: "",
+			description:          "Access denied errors should not expose CORS headers",
+		},
+		{
+			name:                 "ErrInternalError should not trigger fallback",
+			errCode:              s3err.ErrInternalError,
+			expectedOriginHeader: "",
+			description:          "Internal errors should not expose CORS headers",
+		},
+		{
+			name:                 "ErrNoSuchBucket should trigger fallback",
+			errCode:              s3err.ErrNoSuchBucket,
+			expectedOriginHeader: "https://example.com",
+			description:          "Bucket not found errors should expose CORS headers to prevent information disclosure",
+		},
+		{
+			name:                 "ErrNoSuchCORSConfiguration should trigger fallback",
+			errCode:              s3err.ErrNoSuchCORSConfiguration,
+			expectedOriginHeader: "https://example.com",
+			description:          "Explicit no CORS config should use fallback",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			bucketChecker := &mockBucketChecker{bucketExists: true}
+			configGetter := &mockCORSConfigGetter{
+				config:  nil,
+				errCode: tt.errCode,
+			}
+
+			middleware := NewMiddleware(bucketChecker, configGetter, fallbackConfig)
+
+			req := httptest.NewRequest("GET", "/testbucket/testobject", nil)
+			req = mux.SetURLVars(req, map[string]string{
+				"bucket": "testbucket",
+				"object": "testobject",
+			})
+			req.Header.Set("Origin", "https://example.com")
+
+			w := httptest.NewRecorder()
+			nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+			})
+
+			middleware.Handler(nextHandler).ServeHTTP(w, req)
+
+			actualOrigin := w.Header().Get("Access-Control-Allow-Origin")
+			if actualOrigin != tt.expectedOriginHeader {
+				t.Errorf("%s: expected Access-Control-Allow-Origin='%s', got '%s'",
+					tt.description, tt.expectedOriginHeader, actualOrigin)
+			}
+		})
+	}
+}
+
+// TestMiddlewareVaryHeader tests that the Vary: Origin header is correctly applied in various scenarios
+func TestMiddlewareVaryHeader(t *testing.T) {
+	tests := []struct {
+		name                 string
+		bucketConfig         *CORSConfiguration
+		shouldHaveVaryHeader bool
+		description          string
+	}{
+		{
+			name: "Specific allowed origin",
+			bucketConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"https://example.com"},
+						AllowedMethods: []string{"GET"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			shouldHaveVaryHeader: true,
+			description:          "Should have Vary: Origin header when CORS config exists with specific origin",
+		},
+		{
+			name: "Wildcard allowed origin",
+			bucketConfig: &CORSConfiguration{
+				CORSRules: []CORSRule{
+					{
+						AllowedOrigins: []string{"*"},
+						AllowedMethods: []string{"GET"},
+						AllowedHeaders: []string{"*"},
+					},
+				},
+			},
+			shouldHaveVaryHeader: true,
+			description:          "Should have Vary: Origin header even when CORS config has wildcard origin",
+		},
+		{
+			name:                 "No CORS configuration",
+			bucketConfig:         nil,
+			shouldHaveVaryHeader: false,
+			description:          "Should NOT have Vary: Origin header when no CORS config exists",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Setup mocks
+			bucketChecker := &mockBucketChecker{bucketExists: true}
+
+			var errCode s3err.ErrorCode
+			if tt.bucketConfig == nil {
+				errCode = s3err.ErrNoSuchCORSConfiguration
+			} else {
+				errCode = s3err.ErrNone
+			}
+
+			configGetter := &mockCORSConfigGetter{
+				config:  tt.bucketConfig,
+				errCode: errCode,
+			}
+
+			// Create middleware
+			middleware := NewMiddleware(bucketChecker, configGetter, nil)
+
+			// Create request WITHOUT Origin header
+			req := httptest.NewRequest("GET", "/testbucket/testobject", nil)
+			req = mux.SetURLVars(req, map[string]string{
+				"bucket": "testbucket",
+				"object": "testobject",
+			})
+
+			// Create response recorder
+			w := httptest.NewRecorder()
+
+			// Create a simple handler that returns 200 OK
+			nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.WriteHeader(http.StatusOK)
+			})
+
+			// Execute middleware
+			middleware.Handler(nextHandler).ServeHTTP(w, req)
+
+			// Check Vary header
+			hasVaryOrigin := hasVaryOrigin(w.Header())
+
+			if tt.shouldHaveVaryHeader && !hasVaryOrigin {
+				t.Errorf("%s: expected Vary: Origin header, but got %v", tt.description, w.Header()["Vary"])
+			} else if !tt.shouldHaveVaryHeader && hasVaryOrigin {
+				t.Errorf("%s: expected NO Vary: Origin header, but got it", tt.description)
+			}
+		})
+	}
+}
+
+// TestHandleOptionsRequestVaryHeader reproduces the issue where HandleOptionsRequest misses Vary: Origin
+func TestHandleOptionsRequestVaryHeader(t *testing.T) {
+	// Setup mocks
+	bucketChecker := &mockBucketChecker{bucketExists: true}
+
+	config := &CORSConfiguration{
+		CORSRules: []CORSRule{
+			{
+				AllowedOrigins: []string{"https://example.com"},
+				AllowedMethods: []string{"GET", "POST"},
+				AllowedHeaders: []string{"*"},
+			},
+		},
+	}
+
+	configGetter := &mockCORSConfigGetter{
+		config:  config,
+		errCode: s3err.ErrNone,
+	}
+
+	// Create middleware
+	middleware := NewMiddleware(bucketChecker, configGetter, nil)
+
+	// Create OPTIONS request
+	req := httptest.NewRequest("OPTIONS", "/testbucket/testobject", nil)
+	req = mux.SetURLVars(req, map[string]string{
+		"bucket": "testbucket",
+		"object": "testobject",
+	})
+
+	// Set valid CORS headers
+	req.Header.Set("Origin", "https://example.com")
+	req.Header.Set("Access-Control-Request-Method", "GET")
+
+	// Create response recorder
+	w := httptest.NewRecorder()
+
+	// Execute HandleOptionsRequest
+	middleware.HandleOptionsRequest(w, req)
+
+	// Check Response Status
+	if w.Code != http.StatusOK {
+		t.Errorf("Expected status 200, got %d", w.Code)
+	}
+
+	// Check Vary header - verified to FAIL without fix
+	if !hasVaryOrigin(w.Header()) {
+		t.Errorf("Expected Vary: Origin header in OPTIONS response, but got %v", w.Header()["Vary"])
+	}
+}
+
+// hasVaryOrigin checks if the "Vary" header contains "Origin"
+func hasVaryOrigin(header http.Header) bool {
+	varyHeaders := header["Vary"]
+	for _, h := range varyHeaders {
+		for _, v := range strings.Split(h, ",") {
+			if strings.TrimSpace(v) == "Origin" {
+				return true
+			}
+		}
+	}
+	return false
+}