refactor

weed/s3api/s3api_bucket_cors_handlers.go

@@ -45,21 +45,24 @@ func (s3a *S3ApiServer) createFallbackCORSConfig() *cors.CORSConfiguration {
 		return nil
 	}
 
-	// Create a permissive CORS rule based on global allowed origins
-	// This matches the behavior of handleCORSOriginValidation
-	rule := cors.CORSRule{
-		AllowedOrigins: s3a.option.AllowedOrigins,
-		AllowedMethods: []string{"GET", "PUT", "POST", "DELETE", "HEAD"},
-		AllowedHeaders: []string{"*"},
-		// Expose common S3 headers that web applications typically need
-		ExposeHeaders: []string{
+	// Default methods and headers for the fallback configuration
+	fallbackAllowedMethods := []string{"GET", "PUT", "POST", "DELETE", "HEAD"}
+	fallbackExposeHeaders := []string{
 		"ETag",
 		"Content-Length",
 		"Content-Type",
 		"Last-Modified",
 		"x-amz-request-id",
 		"x-amz-version-id",
-		},
+	}
+
+	// Create a permissive CORS rule based on global allowed origins
+	// This matches the behavior of handleCORSOriginValidation
+	rule := cors.CORSRule{
+		AllowedOrigins: s3a.option.AllowedOrigins,
+		AllowedMethods: fallbackAllowedMethods,
+		AllowedHeaders: []string{"*"},
+		ExposeHeaders:  fallbackExposeHeaders,
 		MaxAgeSeconds:  nil, // No max age by default
 	}