Cross-Origin Resource Sharing (CORS) in Object Storage

Configure Cross-Origin Resource Sharing (CORS) for a bucket to make its objects accessible to web applications hosted on a different domain. CORS is a browser security mechanism that controls access to resources from other origins.

For example, if you have images in a bucket named my-example-bucket and want to display them on a website at https://example.com, you add a CORS rule to my-example-bucket that allows access from https://example.com.

Prerequisites

• Object Storage enabled and credentials configured: Enable Object Storage
• AWS CLI installed and configured for STACKIT Object Storage: Set up the AWS CLI

CORS rule structure

A CORS rule can be defined as XML or JSON. Each rule consists of:

Element	Description
ID	Identifies the rule. Multiple rules can be defined per bucket.
AllowedOrigin	The origin to allow access from. Use * to allow all origins.
AllowedMethod	HTTP methods allowed on the objects: GET, PUT, DELETE, or HEAD.
AllowedHeader	Headers allowed in the request. Use * to allow all headers.
ExposeHeader	Response headers provided back to the application.
MaxAgeSeconds	Duration in seconds that the preflight response can be cached.

Set CORS rules

Create a CORS configuration file in JSON format. The following example allows GET and HEAD access from my-app.com:

{
  "CORSRules": [
    {
      "ID": "Allow Bucket for my-app.com",
      "AllowedOrigins": [
        "https://www.my-app.com",
        "http://www.my-app.com",
        "https://my-app.com",
        "http://my-app.com"
      ],
      "AllowedMethods": ["GET", "HEAD"],
      "AllowedHeaders": ["Content-*", "Host"],
      "ExposeHeaders": ["ETag"],
      "MaxAgeSeconds": 86400
    }
  ]
}

Apply the configuration file to your bucket:

aws s3api put-bucket-cors \
  --bucket my-example-bucket \
  --cors-configuration file://cors-rules.json \
  --endpoint-url https://object.storage.eu01.onstackit.cloud

Get CORS rules

Retrieve the current CORS configuration for a bucket:

aws s3api get-bucket-cors \
  --bucket my-example-bucket \
  --endpoint-url https://object.storage.eu01.onstackit.cloud

Delete CORS rules

To remove all CORS rules from a bucket:

aws s3api delete-bucket-cors \
  --bucket my-example-bucket \
  --endpoint-url https://object.storage.eu01.onstackit.cloud