Tous les produits
Search
Centre de documentation

Object Storage Service:Partage de ressources cross-origin (SDK Node.js)

Dernière mise à jour :Aug 18, 2026

Le partage de ressources cross-origin (CORS) permet aux applications web d'accéder à des ressources hébergées sur un domaine différent. OSS propose des opérations d'API CORS pour gérer les autorisations d'accès inter-domaines.

Définir des règles CORS

Le code suivant définit les règles CORS pour un bucket :

const OSS = require('ali-oss');

const client = new OSS({
  // Set yourRegion to the region where the bucket is located. For example, if the bucket is in the China (Hangzhou) region, set Region to oss-cn-hangzhou.
  region: 'yourRegion',
  // Obtain access credentials from environment variables. Before running this sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are set.
  accessKeyId: process.env.OSS_ACCESS_KEY_ID,
  accessKeySecret: process.env.OSS_ACCESS_KEY_SECRET,
  authorizationV4: true,
  // Specify the bucket name.
  bucket: 'yourBucket'
});

const rules = [{
        // Specify the allowed origins for cross-origin requests. The wildcard character asterisk (*) is supported, which allows all source domains.
        allowedOrigin: 'http://example.com',
        // Specify the allowed methods for cross-origin requests. Supported methods include GET, PUT, DELETE, POST, and HEAD.
        allowedMethod: 'GET',
        // Specify the allowed response headers for cross-origin requests. Set this to the wildcard character asterisk (*) unless you have specific requirements.
        allowedHeader: '*',
        // Specify the response headers that users can access from applications, such as a JavaScript XMLHttpRequest object. The wildcard character asterisk (*) is not allowed.
        exposeHeader: 'Content-Length',
        // Specify the cache duration, in seconds, for the results of preflight (OPTIONS) requests for a specific resource.
        maxAgeSeconds: '30'
  },
];
// Set a maximum of 10 CORS rules. If you configure a rule that is the same as an existing one, the existing rule is overwritten.
client.putBucketCORS("yourBucket", rules).then((r) => {
  console.log(r);
});           

Récupérer les règles CORS

Le code suivant récupère les règles CORS d'un bucket :

const OSS = require("ali-oss");
const assert = require("assert");

const client = new OSS({
  // Set yourRegion to the region where the bucket is located. For example, if the bucket is in the China (Hangzhou) region, set Region to oss-cn-hangzhou.
  region: 'yourRegion',
  // Obtain access credentials from environment variables. Before running this sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are set.
  accessKeyId: process.env.OSS_ACCESS_KEY_ID,
  accessKeySecret: process.env.OSS_ACCESS_KEY_SECRET,
  authorizationV4: true,
  // Specify the bucket name.
  bucket: "yourBucket",
});

// Specify the bucket name.
client.getBucketCORS("yourBucket").then((r) => {
  assert.equal(r.res.status, 200);
  assert.deepEqual(r.rules, [
    {
      allowedOrigin: "http://example.com",
      allowedMethod: "GET",
      allowedHeader: "*",
      exposeHeader: "Content-Length",
      maxAgeSeconds: "30",
    },
  ]);
});

Supprimer les règles CORS

Le code suivant supprime toutes les règles CORS d'un bucket :

const OSS = require('ali-oss');

const client = new OSS({
  // Set yourRegion to the region where the bucket is located. For example, if the bucket is in the China (Hangzhou) region, set Region to oss-cn-hangzhou.
  region: 'yourRegion',
  // Obtain access credentials from environment variables. Before running this sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are set.
  accessKeyId: process.env.OSS_ACCESS_KEY_ID,
  accessKeySecret: process.env.OSS_ACCESS_KEY_SECRET,
  authorizationV4: true,
  // Specify the bucket name.
  bucket: "yourBucket",
});

// Specify the bucket name.
client.deleteBucketCORS('yourBucket').then((res) => {
  console.log(res);
}).catch(e => {
  console.log(e)
})

Références

  • Pour consulter l'exemple de code complet relatif au partage de ressources cross-origin, voir les exemples GitHub.

  • Pour plus d'informations sur l'opération d'API permettant de définir des règles CORS, voir PutBucketCors.

  • Pour plus d'informations sur l'opération d'API permettant de récupérer les règles CORS, voir GetBucketCors.

  • Pour plus d'informations sur l'opération d'API permettant de supprimer les règles CORS, voir DeleteBucketCors.