Process Options before auth (#964)

Closes #899.

api/handler/cors.go

@@ -136,6 +136,10 @@ func (h *handler) AppendCORSHeaders(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *handler) Preflight(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodOptions {
+		return
+	}
+
 	reqInfo := api.GetReqInfo(r.Context())
 	bktInfo, err := h.obj.GetBucketInfo(r.Context(), reqInfo.BucketName)
 	if err != nil {
@@ -146,6 +150,7 @@ func (h *handler) Preflight(w http.ResponseWriter, r *http.Request) {
 	origin := r.Header.Get(api.Origin)
 	if origin == "" {
 		h.logAndSendError(w, "origin request header needed", reqInfo, s3errors.GetAPIError(s3errors.ErrBadRequest))
+		return
 	}
 
 	method := r.Header.Get(api.AccessControlRequestMethod)

api/router.go

@@ -150,6 +150,21 @@ func appendCORS(handler Handler) mux.MiddlewareFunc {
 	}
 }
 
+func appendPreflight(handler Handler) mux.MiddlewareFunc {
+	return func(h http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			handler.Preflight(w, r)
+			if www, ok := w.(*logResponseWriter); ok {
+				if www.statusCode != 0 {
+					return
+				}
+			}
+
+			h.ServeHTTP(w, r)
+		})
+	}
+}
+
 func logErrorResponse(l *zap.Logger) mux.MiddlewareFunc {
 	return func(h http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -199,6 +214,8 @@ func Attach(r *mux.Router, domains []string, m MaxClients, h Handler, center aut
 
 		// -- logging error requests
 		logErrorResponse(log),
+
+		appendPreflight(h),
 	)
 
 	// Attach user authentication for all S3 routes.