fix(s3): keep host-less bucket catch-all so reverse proxies work (#9540)

When s3.domainName is set, all bucket-prefix routes were gated on a
matching Host header. Requests that arrive via an IP, an unlisted
hostname, or a reverse proxy that rewrites Host hit no router and bounce
back as 405/404 (and 503 once a proxy maps the upstream error).

Register the path-style catch-all unconditionally, after the
host-specific routers, so it only fires when no Host matcher applies.
This commit is contained in:
Chris Lu authored and GitHub committed 2026-05-18 19:44:19 -07:00
1 parent d3f80444df
commit 58c3fa802c
2 files changed
+45 -2

No files matched your search

+5 -2
View File
@@ -684,9 +684,12 @@ func (s3a *S3ApiServer) registerRouter(router *mux.Router) {
routers = append(routers, apiRouter.Host(
fmt.Sprintf("%s.%s", "{bucket:.+}", virtualHost)).Subrouter())
}
} else {
routers = append(routers, apiRouter.PathPrefix("/{bucket}").Subrouter())
}
// Always register a Host-less path-style catch-all last so requests that
// arrive via an IP, an unlisted hostname, or a reverse proxy that rewrites
// the Host header still match bucket routes. Host-specific routers above
// take precedence because they were registered first.
routers = append(routers, apiRouter.PathPrefix("/{bucket}").Subrouter())
// Get CORS middleware instance with caching
corsMiddleware := s3a.getCORSMiddleware()