Cross-Origin Resource Sharing (CORS) is an HTTP header-based standard that lets the owner of a resource declare which origins are allowed to read that resource, and that browsers enforce on the client side. OSS supports the CORS standard at the bucket level: the operations in this group manage the CORS configuration of a bucket.
How CORS works with OSS
Configure CORS when JavaScript that runs on one origin calls OSS on another origin, for example when a page served from your own domain uploads objects to or downloads objects from a bucket directly. The CORS configuration of the bucket declares which origins the browser may accept:
Origin comparison — A browser treats a request as cross-origin when the scheme, host, or port of the target URL differs from the origin of the page that issues the request.
Declaration by the resource owner — Allowed origins are declared in the CORS configuration of the bucket that holds the objects, not in the client that sends the request.
Preflight request — Before it sends certain cross-origin requests, the browser sends an
OPTIONSrequest to OSS to ask whether the actual request is allowed. OSS answers based on the CORS configuration of the bucket.Browser enforcement — The browser compares the CORS response headers that OSS returns with the origin of the page. If the origin is not allowed, the browser blocks the page from reading the response.
CORS is not an access control mechanism. A CORS rule declares which origins a browser may expose a response to. It does not decide who can access the data in a bucket. Control access to your data with the access control features of OSS.
Operations
Manage the CORS configuration of a bucket
The following operations create, query, and remove the CORS rules of a bucket. Configure the rules first, then query or remove them as needed:
PutBucketCORS — Configures the CORS rules of a bucket. This operation is the entry point of the group: call it to declare the origins that are allowed to send cross-origin requests to the bucket.
GetBucketCORS — Queries the CORS rules that are configured for a bucket. Call it to review the current configuration before you change or remove it.
DeleteBucketCORS — Removes the CORS configuration from a bucket.
DeleteBucketCORS removes the CORS rules of the bucket, so browsers no longer receive a response that permits cross-origin requests to that bucket. Call GetBucketCORS first and save the returned configuration so that you can restore it with PutBucketCORS.
Handle browser preflight requests
OSS answers the preflight request that a browser sends before a cross-origin request. This part of the flow is driven by the browser rather than by a configuration task in your application code:
OptionObject — Handles the preflight
OPTIONSrequest for an object. The browser sends this request automatically, so application code does not normally call the operation directly.
If a browser blocks a cross-origin request to a bucket, query the current rules with GetBucketCORS and compare them with the origin, method, and headers of the request that the browser sends.