R2 replying with 401 to OPTIONS requests
# r2s
sparkyga
12/16/2023, 5:43 PMHave a problem with a public bucket on R2, it connected to public domain. Users are allowed to reuse images from our site (due to a Creative Common licence) - so they use 'copy image url', then paste the URL into file open diaglog (ie from a Choose File with ). Example URL:
http://s1.geograph.org.uk/photos/08/35/083525_9a106acb_393x300.jpg▾
sparkyga
12/16/2023, 5:45 PMThe problem is Windows, make a OPTIONS request initially. But r2 is responding with 401, which causes Windows to display a login diaglog (persumably so could then send with Basic-Auth)
sparkyga
12/16/2023, 5:45 PM> OPTIONS /photos/08/35/083525_9a106acb_393x300.jpg HTTP/1.1
> Host: s1.geograph.org.uk
> User-Agent: curl/7.74.0
> Accept: /
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 401 Unauthorized
< Date: Sat, 16 Dec 2023 17:43:54 GMT
< Content-Type: text/html
< Transfer-Encoding: chunked
k
kian
12/16/2023, 5:45 PMHave you seen this 401 in an actual browser or when manually sending an
OPTIONSkian
12/16/2023, 5:46 PMIf there's no
Origins
sparkyga
12/16/2023, 5:48 PMI dont think windows is technically doing a CORS request, it just (it seems) using OPTIONS to see if exists etc. heres a real request from windows:
sparkyga
12/16/2023, 5:50 PM(sorry reposting, copy/pasted the wrong one)
OPTIONS HTTP/1.1
Connection: Keep-Alive
User-Agent: Microsoft-WebDAV-MiniRedir/10.0.22631
translate: f
Host: s1.geograph.org.uk
HTTP/1.1 401 Unauthorized
Date: Sat, 16 Dec 2023 17:27:30 GMT
Content-Type: text/html
http://s1.geograph.org.uk/photos/08/35/083525_9a106acb_393x300.jpg▾
sparkyga
12/16/2023, 5:51 PMnotice the request from windows, has the full url (starting http:// in the OPTIONS line, not just the path!
u
Unsmart | Tech debt
12/16/2023, 5:59 PMWhat exactly are you doing that causes the request?
s
sparkyga
12/16/2023, 6:02 PMIts pasting the URL into the 'File name' in the Windows Open Diaglog. Admittedly kinda wierd, but its a quick way of copying a file. Windows, will download the file from the URL into a temporally folder, which can then upload to another site.
sparkyga
12/16/2023, 6:04 PMbecause windows only gets 401 responce from Cloudflare/R2, it prompts for password:
u
Unsmart | Tech debt
12/16/2023, 6:07 PMI didnt even know that was possible
s
sparkyga
12/16/2023, 6:11 PMCan copy this file: - even though it via cloudflare as well, our origin responds with 200 to the OPTIONS request, which windows, the follows up with standard GET to actully grab the file.
https://t0.geograph.org.uk/stamped/083525_9a106acb.jpg▾
u
Unsmart | Tech debt
12/16/2023, 6:20 PMNot sure if you can really fix that with the R2 service itself but you could proxy through a worker and if the request is an OPTIONS respond with whatever cors options you want.
s
sparkyga
12/16/2023, 6:35 PMAs say dont think it anything to do with CORS as such, the OPTIONS is used for WebDav checking. Out of interest checked what AWS/S3 does, they respond with 400 to all the OPTIONS, and windows doesnt seem to mind that. 400 (or 405) seems like would be a better responce to the the OPTIONS than 401.
sparkyga
12/16/2023, 6:38 PMI've wondered about a worker. Although we using Sippy, not sure if that compatible.
k
kian
12/16/2023, 6:44 PMA 400/405 is more appropriate - a 401 indicates missing auth but there is no auth to provide here.
kian
12/16/2023, 6:44 PMcc @Sid | R2
kian
12/16/2023, 6:44 PMIf you have a paid plan, you might want to open a support ticket.
s
sparkyga
12/16/2023, 7:52 PMOk thanks. Alas only using free plan. Seems like a worker might work. I've been able to deploy a worker, and it responds with 405 to the OPTIONS request. basically a copy/paste of the demo worker from R2 docs, but removed the PUT/DELETE responders! Seem to be able to paste this URL into the Open dialog - windows ignores the 405, and makes the final GET correctly. (it connected to a different test bucket for now, so doesnt have the above image in it)
https://worker-long-rain-6cc6.webmaster-9e7.workers.dev/Capture-compass.JPG▾
sparkyga
12/16/2023, 7:59 PMOf will need to make the worker, actually respond to proper CORS preflights, that have the Origin header.
s
Sid | R2
12/31/2023, 3:52 PMSo TL;DR is that Windows doesn’t send an Origin header in its OPTIONS request, and you’d like R2 to respond with a 400 instead of a 401? That sounds reasonable.
Sid | R2
01/02/2024, 7:11 PMThanks for reporting this! I’d never have found this myself.
I’ve made this change, but it might be a while till this gets released.
Sid | R2
01/02/2024, 7:12 PMWe’ll return a 400 for OPTIONS requests without an Origin header