HTTP/403 on console based preview & download

[steve-o]

Expected Behavior

Cannot download or preview in web UI.

Current Behavior

Version RELEASE.2023-05-18T00-05-36Z accepts uploads and can preview via the console, the latest version RELEASE.2023-11-20T22-40-07Z with the same uploads reports 403 in the console.

The HTTP/403 is also reported in the trace tools.

Using mc and any other method works fine. The content is correct and valid.

The share action also works and can see the content.

Steps to Reproduce (for bugs)

1. Install
2. Upload content
3. Try to download or preview in UI.

Regression

Yes.

Your Environment

Fresh install via Docker Hub.

[prakashsvmx]

is there a policy attached to a user ? please run the trace via mc admin trace <ALIAS> -v and capture while uploading from console.

[steve-o]

No, a very empty install. The log on the preview request is more enlightening:

s3.dsbunny.uk [RESPONSE] [2023-11-27T23:20:33.757] [ Duration 131µs TTFB 122.391µs ↑ 231 B  ↓ 451 B ]
s3.dsbunny.uk 403 Forbidden
s3.dsbunny.uk X-Xss-Protection: 1; mode=block
s3.dsbunny.uk Content-Length: 451
s3.dsbunny.uk Content-Type: application/xml
s3.dsbunny.uk Strict-Transport-Security: max-age=31536000; includeSubDomains
s3.dsbunny.uk X-Amz-Request-Id: 179BAE93B97B4020
s3.dsbunny.uk X-Content-Type-Options: nosniff
s3.dsbunny.uk Accept-Ranges: bytes
s3.dsbunny.uk Server: MinIO
s3.dsbunny.uk Vary: Origin,Accept-Encoding
s3.dsbunny.uk X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8
s3.dsbunny.uk <?xml version="1.0" encoding="UTF-8"?>
<Error><Code>SignatureDoesNotMatch</Code><Message>The request signature we calculated does not match the signature you provided. Check your key and signing method.</Message>

[steve-o]

Ah, appears to be related to being routed by Cloudflare Tunnel. Reconfiguring for direct access on the LAN operates as expected.

The error message is not very useful here.

[steve-o]

Similar to minio/minio#15506

If I disable caching via "development mode" in Cloudflare then access is correct.