Repository: minio/minio (language: go)

Issue:
Access-Control-Allow-OriginHeader Not set correctly in container version minio/minio:RELEASE.2023-07-21T21-12-44Z
After upgrading from docker container minio/minio:RELEASE.2023-06-29T05-12-28Z to minio/minio:RELEASE.2023-07-21T21-12-44Z, the Access-Control-Allow-Origin Header header is now set to '*' instead of the configured value.

## Expected Behavior

Set the "Cors Allow Origin" setting to "https://*.example.com"
Perform a request to the bucket with the origin header set
The response should return the "Access-Control-Allow-Origin" set to the value of the origin

## Current Behavior

"Access-Control-Allow-Origin" is set to '*'


## Steps to Reproduce (for bugs)

Set the "Cors Allow Origin" setting to "https://*.example.com" in the admin console
Perform a request to the bucket with the origin header set: ex

```python
import requests

public_url = f"https://minio.example.com/bucket/test"
origin = 'https://other-sub-domain.example.com/'
session = requests.Session()
session.headers.update({'origin': origin})
output = session.get(public_url)
header_value = output.headers['Access-Control-Allow-Origin']

assert header_value == origin

```

The response should return the "Access-Control-Allow-Origin" set to the value of the origin

## Context

We are using the Access-Control-Allow-Origin header on version  RELEASE.2023-06-29T05-12-28Z and the behavior changed on RELEASE.2023-07-21T21-12-44Z

## Regression

Yes

## Your Environment

This instance is running in Azure Kubernetes, using the docker container with tag RELEASE.2023-07-21T21-12-44Z 




Discussion / hints:
Yeah, it's a broken change here. And that is acceptable. What business of yours has been affected by this? @wcbzero 
My user's downstream applications had broke previously when the header was set to '*'. We dont have an urgent need to upgrade at this time. Is this a broken change that will be corrected in a future release?
> My user's downstream applications had broke previously when the header was set to '*'. We dont have an urgent need to upgrade at this time. Is this a broken change that will be corrected in a future release?

why would it break? `*` is allowed here according to the HTTP spec what is the value that is set for allowed origins on the server? 

Fix patch:
diff --git a/.github/workflows/vulncheck.yml b/.github/workflows/vulncheck.yml
index c6f4431009031..7831815808c43 100644
--- a/.github/workflows/vulncheck.yml
+++ b/.github/workflows/vulncheck.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: 1.19.11
+          go-version: 1.19.12
           check-latest: true
       - name: Get official govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest
diff --git a/cmd/api-router.go b/cmd/api-router.go
index 3bd9eb7d2740c..d4e118e1c4c2c 100644
--- a/cmd/api-router.go
+++ b/cmd/api-router.go
@@ -545,12 +545,5 @@ func corsHandler(handler http.Handler) http.Handler {
 		ExposedHeaders:   commonS3Headers,
 		AllowCredentials: true,
 	}
-	for _, origin := range globalAPIConfig.getCorsAllowOrigins() {
-		if origin == "*" {
-			opts.AllowOriginFunc = nil
-			opts.AllowedOrigins = globalAPIConfig.getCorsAllowOrigins()
-			break
-		}
-	}
 	return cors.New(opts).Handler(handler)
 }
diff --git a/cmd/generic-handlers.go b/cmd/generic-handlers.go
index 506e8c561d2dd..50f158b6d0d98 100644
--- a/cmd/generic-handlers.go
+++ b/cmd/generic-handlers.go
@@ -443,6 +443,11 @@ func setRequestValidityMiddleware(h http.Handler) http.Handler {
 // is obtained from centralized etcd configuration service.
 func setBucketForwardingMiddleware(h http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if origin := w.Header().Get("Access-Control-Allow-Origin"); origin == "null" {
+			// This is a workaround change to ensure that "Origin: null"
+			// incoming request to a response back as "*" instead of "null"
+			w.Header().Set("Access-Control-Allow-Origin", "*")
+		}
 		if globalDNSConfig == nil || !globalBucketFederation ||
 			guessIsHealthCheckReq(r) || guessIsMetricsReq(r) ||
 			guessIsRPCReq(r) || guessIsLoginSTSReq(r) || isAdminReq(r) {


Test patch:
diff --git a/cmd/server_test.go b/cmd/server_test.go
index f81c82a7deaa3..8463593bc917b 100644
--- a/cmd/server_test.go
+++ b/cmd/server_test.go
@@ -219,7 +219,7 @@ func (s *TestSuiteCommon) TestBucketSQSNotificationWebHook(c *check) {
 func (s *TestSuiteCommon) TestCors(c *check) {
 	expectedMap := http.Header{}
 	expectedMap.Set("Access-Control-Allow-Credentials", "true")
-	expectedMap.Set("Access-Control-Allow-Origin", "*")
+	expectedMap.Set("Access-Control-Allow-Origin", "http://foobar.com")
 	expectedMap["Access-Control-Expose-Headers"] = []string{
 		"Date",
 		"Etag",