Repository: minio/minio (language: go)

Issue:
CORS 'Access-Control-Allow-Origin' header missing in responses
This is related with the issue https://github.com/minio/minio/issues/11111.
We had just faced that issue in our kubernetes environment (we don't use helm charts there) and, as it was said in the previous issue, the root cause was related to minIO configs that were corrupted. 

I want to share the way to fix it, as in the other issue some people suggest to recreate the volume so the configs were created again, but that was not possible in our env, and I guess is not always posible to delete the existing volume.

We tried to manually set the cors config again using the minIO CLI, and there is how the solution to the problem appeared!
```
user@user-mbp minio % mc admin config set dc-fs api "cors_allow_origin=*"
mc: <ERROR> Unable to set 'api cors_allow_origin=*' to server: found invalid keys (extend_list_cache_life=0s ) for 'api' sub-system, use 'mc admin config reset myminio api' to fix invalid keys.

user@user-mbp minio % mc admin config reset dc-fs api
Key is successfully reset.

user@user-mbp minio % mc admin config set dc-fs api "cors_allow_origin=*"
Successfully applied new settings.
```

*How we narrow down the issue to a minIO config issue that only appears after the upgrade?*
CORS wasn't working in one env that was updated some time ago, but *it was working fine* in another env that was still using a previous minIO version. We upgrade that env that was working fine, and we started facing the CORS issue there, meaning that after the upgrade, minIO brakes the CORS config in some way. But, using that new minIO version with a fresh installation, that was working fine. So the problem only raised after the upgrade.

_Originally posted by @harshavardhana in https://github.com/minio/minio/issues/11111#issuecomment-797853784_
            


Discussion / hints:
> user@user-mbp minio % mc admin config set dc-fs api "cors_allow_origin=*"

which version of MinIO are you running @diegofmole - please provide more details in your issue report. 

Please provide details on which version to which version the upgrade was performed.


We were using:
- RELEASE.2021-06-14T01-29-23Z tag

And we upgrade to:
- RELEASE.2022-11-26T22-43-32Z tag
Its because of deprecated keys

> mc: <ERROR> Unable to set 'api cors_allow_origin=*' to server: found invalid keys (extend_list_cache_life=0s ) for 'api' sub-system, use 'mc admin config reset myminio api' to fix invalid keys.

Let me check what challenges are here and if we can automatically handle it. 

Fix patch:
diff --git a/cmd/api-router.go b/cmd/api-router.go
index 9da5d1f525f0e..0bef3137bcba8 100644
--- a/cmd/api-router.go
+++ b/cmd/api-router.go
@@ -516,7 +516,11 @@ func corsHandler(handler http.Handler) http.Handler {
 
 	return cors.New(cors.Options{
 		AllowOriginFunc: func(origin string) bool {
-			for _, allowedOrigin := range globalAPIConfig.getCorsAllowOrigins() {
+			allowedOrigins := globalAPIConfig.getCorsAllowOrigins()
+			if len(allowedOrigins) == 0 {
+				allowedOrigins = []string{"*"}
+			}
+			for _, allowedOrigin := range allowedOrigins {
 				if wildcard.MatchSimple(allowedOrigin, origin) {
 					return true
 				}
diff --git a/internal/config/api/api.go b/internal/config/api/api.go
index d15d17d38a6b4..2b92cf49cf298 100644
--- a/internal/config/api/api.go
+++ b/internal/config/api/api.go
@@ -20,6 +20,7 @@ package api
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"runtime"
 	"strconv"
 	"strings"
@@ -193,6 +194,9 @@ func LookupConfig(kvs config.KVS) (cfg Config, err error) {
 	}
 
 	corsAllowOrigin := strings.Split(env.Get(EnvAPICorsAllowOrigin, kvs.Get(apiCorsAllowOrigin)), ",")
+	if len(corsAllowOrigin) == 0 {
+		corsAllowOrigin = []string{"*"} // defaults to '*'
+	}
 
 	remoteTransportDeadline, err := time.ParseDuration(env.Get(EnvAPIRemoteTransportDeadline, kvs.GetWithDefault(apiRemoteTransportDeadline, DefaultKVS)))
 	if err != nil {
@@ -203,14 +207,14 @@ func LookupConfig(kvs config.KVS) (cfg Config, err error) {
 	switch listQuorum {
 	case "strict", "optimal", "reduced", "disk":
 	default:
-		return cfg, errors.New("invalid value for list strict quorum")
+		return cfg, fmt.Errorf("invalid value %v for list_quorum", listQuorum)
 	}
 
 	replicationPriority := env.Get(EnvAPIReplicationPriority, kvs.GetWithDefault(apiReplicationPriority, DefaultKVS))
 	switch replicationPriority {
 	case "slow", "fast", "auto":
 	default:
-		return cfg, errors.New("invalid value for replication priority")
+		return cfg, fmt.Errorf("invalid value %v for replication_priority", replicationPriority)
 	}
 
 	transitionWorkers, err := strconv.Atoi(env.Get(EnvAPITransitionWorkers, kvs.GetWithDefault(apiTransitionWorkers, DefaultKVS)))
@@ -242,7 +246,6 @@ func LookupConfig(kvs config.KVS) (cfg Config, err error) {
 	}
 
 	disableODirect := env.Get(EnvAPIDisableODirect, kvs.Get(apiDisableODirect)) == config.EnableOn
-
 	gzipObjects := env.Get(EnvAPIGzipObjects, kvs.Get(apiGzipObjects)) == config.EnableOn
 
 	return Config{


Test patch: