Le partage de ressources cross-origin (CORS) permet aux applications web d'accéder à des ressources hébergées sur un domaine différent. OSS propose des opérations d'API CORS pour gérer les autorisations d'accès inter-domaines.
Définir des règles CORS
Le code suivant définit les règles CORS pour un bucket :
const OSS = require('ali-oss');
const client = new OSS({
// Set yourRegion to the region where the bucket is located. For example, if the bucket is in the China (Hangzhou) region, set Region to oss-cn-hangzhou.
region: 'yourRegion',
// Obtain access credentials from environment variables. Before running this sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are set.
accessKeyId: process.env.OSS_ACCESS_KEY_ID,
accessKeySecret: process.env.OSS_ACCESS_KEY_SECRET,
authorizationV4: true,
// Specify the bucket name.
bucket: 'yourBucket'
});
const rules = [{
// Specify the allowed origins for cross-origin requests. The wildcard character asterisk (*) is supported, which allows all source domains.
allowedOrigin: 'http://example.com',
// Specify the allowed methods for cross-origin requests. Supported methods include GET, PUT, DELETE, POST, and HEAD.
allowedMethod: 'GET',
// Specify the allowed response headers for cross-origin requests. Set this to the wildcard character asterisk (*) unless you have specific requirements.
allowedHeader: '*',
// Specify the response headers that users can access from applications, such as a JavaScript XMLHttpRequest object. The wildcard character asterisk (*) is not allowed.
exposeHeader: 'Content-Length',
// Specify the cache duration, in seconds, for the results of preflight (OPTIONS) requests for a specific resource.
maxAgeSeconds: '30'
},
];
// Set a maximum of 10 CORS rules. If you configure a rule that is the same as an existing one, the existing rule is overwritten.
client.putBucketCORS("yourBucket", rules).then((r) => {
console.log(r);
});
Récupérer les règles CORS
Le code suivant récupère les règles CORS d'un bucket :
const OSS = require("ali-oss");
const assert = require("assert");
const client = new OSS({
// Set yourRegion to the region where the bucket is located. For example, if the bucket is in the China (Hangzhou) region, set Region to oss-cn-hangzhou.
region: 'yourRegion',
// Obtain access credentials from environment variables. Before running this sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are set.
accessKeyId: process.env.OSS_ACCESS_KEY_ID,
accessKeySecret: process.env.OSS_ACCESS_KEY_SECRET,
authorizationV4: true,
// Specify the bucket name.
bucket: "yourBucket",
});
// Specify the bucket name.
client.getBucketCORS("yourBucket").then((r) => {
assert.equal(r.res.status, 200);
assert.deepEqual(r.rules, [
{
allowedOrigin: "http://example.com",
allowedMethod: "GET",
allowedHeader: "*",
exposeHeader: "Content-Length",
maxAgeSeconds: "30",
},
]);
});
Supprimer les règles CORS
Le code suivant supprime toutes les règles CORS d'un bucket :
const OSS = require('ali-oss');
const client = new OSS({
// Set yourRegion to the region where the bucket is located. For example, if the bucket is in the China (Hangzhou) region, set Region to oss-cn-hangzhou.
region: 'yourRegion',
// Obtain access credentials from environment variables. Before running this sample code, make sure that the OSS_ACCESS_KEY_ID and OSS_ACCESS_KEY_SECRET environment variables are set.
accessKeyId: process.env.OSS_ACCESS_KEY_ID,
accessKeySecret: process.env.OSS_ACCESS_KEY_SECRET,
authorizationV4: true,
// Specify the bucket name.
bucket: "yourBucket",
});
// Specify the bucket name.
client.deleteBucketCORS('yourBucket').then((res) => {
console.log(res);
}).catch(e => {
console.log(e)
})
Références
Pour consulter l'exemple de code complet relatif au partage de ressources cross-origin, voir les exemples GitHub.
Pour plus d'informations sur l'opération d'API permettant de définir des règles CORS, voir PutBucketCors.
Pour plus d'informations sur l'opération d'API permettant de récupérer les règles CORS, voir GetBucketCors.
Pour plus d'informations sur l'opération d'API permettant de supprimer les règles CORS, voir DeleteBucketCors.