Ma77Ball commented on code in PR #8562:
URL: https://github.com/apache/texera/pull/8562#discussion_r4032812647
##########
bin/k8s/values.yaml:
##########
@@ -111,6 +111,9 @@ rustfs:
rustfs:
access_key: texera_rustfs
secret_key: password
+ extraEnv:
+ - name: RUSTFS_CORS_ALLOWED_ORIGINS
+ value: "*"
Review Comment:
Nit (P3): the shipped chart default is wide-open CORS with no inline
rationale, unlike every other non-obvious env line in this file (the
SigV4/region notes right below explain themselves).
Why it matters: `RUSTFS_CORS_ALLOWED_ORIGINS=*` on the object store is
exactly what a later security pass flags; a one-line note on why wildcard is
safe here (no credentials, presigned URLs carry no cookies) and how to narrow
it prevents that round-trip and matches the file's commenting convention. Not
blocking.
Suggested fix:
```suggestion
# Presigned dataset-preview URLs are fetched cross-origin from the browser;
# RustFS sends no CORS headers unless this is set. Wildcard is safe here:
it
# never allows credentialed requests and presigned URLs carry no cookies.
# Override with a specific GUI origin to use an allow-list.
extraEnv:
- name: RUSTFS_CORS_ALLOWED_ORIGINS
value: "*"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
