Configuring CORS
This operation allows you to enable Cross-Origin Resource Sharing (CORS) for specific buckets.
CORS is a standard mechanism proposed by the World Wide Web Consortium (W3C) that enables cross-origin requests from servers. In standard web page requests, the scripts and content of one website cannot interact with those of another website, as they are subject to the same Same-Origin Policy (SOP).
centron S3 Object Storage allows static web resources to be stored in buckets. The buckets in centron S3 Object Storage can serve as website resources if used correctly. For further details, see the section on ‘PUT Bucket Website’. A website in centron S3 Object Storage can only respond to requests from other websites if CORS is configured correctly.
Typical use cases include:
With CORS support, you can use JavaScript and HTML5 to create web applications and access resources in centron and S3 Object Storage directly, without having to use a proxy server for the transfer.
You can enable the HTML5 drag-and-drop function to upload files directly to centron S3 Object Storage (with an upload progress indicator) or to update centron S3 Object Storage content using web applications.
You can host external websites, style sheets and HTML5 applications on different domains. Web fonts or images on centron and S3 Object Storage can be shared across multiple websites.
Only users with the s3:PutBucketCORS permission can perform this operation. By default, only the bucket owner can perform this operation. The bucket owner can allow other users to perform this operation by granting them the relevant permission. Once the CORS configuration for the bucket has been set, it takes effect within 2 minutes.
Request Syntax
PUT /?cors HTTP/1.1
Host: bucketname.s3.example.com
User-Agent: agent
Accept: */*
Date: date
Authorization: authorization
Content-MD5: MD5
Content-Length: length
Expect: expect
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration>
<CORSRule>
<ID>id</ID>
<AllowedMethod>method</AllowedMethod>
<AllowedOrigin>origin</AllowedOrigin>
<AllowedHeader>header</AllowedHeader>
<MaxAgeSeconds>seconds</MaxAgeSeconds>
<ExposeHeader>header</ExposeHeader>
</CORSRule>
</CORSConfiguration>
Request Parameters
This request does not contain any parameters.
Request Headers
| Header | Description | Comments |
|---|---|---|
| Content-MD5 | The MD5 digest string of the message text is calculated in accordance with the RFC 1864 standard. This means that the 128-bit binary field (the message header data encrypted with MD5) is first calculated. The binary data is then converted into a string using Base64 encoding. Type: String Example: n58IG6hfM7vqI4K0vnWpog== | Mandatory |
| x-amz-security-token | Header field for identifying a federated user’s request. When the federated authentication feature is enabled, users sending such requests are identified as federated users. Type: string | Optional. This parameter must be included in the request sent by federated users. |
Request elements
In this request, you must configure the CORS settings for buckets in the request body. The configuration information is uploaded in XML format. The table below lists the CORS configuration elements.
| Element | Description | Comments |
|---|---|---|
| CORSConfiguration | Specifies the CORSRules root node. The maximum size is 64 KB. Type: Container Ancestor: None | Required |
| CORSRule | Denotes a CORS rule. CORSConfiguration can contain up to 100 rules. Type: Container Ancestor: CORSConfiguration | Required |
| ID | Specifies the unique identifier of a rule. The value may contain a maximum of 255 characters. Type: String Ancestor: Rule | Optional |
| AllowedMethod | Indicates a method permitted by a CORS rule. Type: String Valid values: GET, PUT, HEAD, POST, and DELETE Ancestor: Rule | Required |
| AllowedOrigin | Specifies an origin permitted by a CORS rule. It is a string that may contain a wildcard (*). Each AllowedOrigin may only contain a wildcard value ( Type: String Ancestor: Rule | Mandatory |
| AllowedHeader | Specifies a permitted header (Access-Control-Request-Headers) in a CORS request. If a request contains Access-Control-Request-Headers, only a CORS request that matches the configuration of AllowedHeader is considered a valid request. Each AllowedHeader may contain only one wildcard (*). Type: String Ancestor: Rule | Optional |
| MaxAgeSeconds | Specifies the duration for which a CORS response may be cached by a server. It is expressed in seconds. Each CORSRule may contain only one MaxAgeSeconds. It can be set to a negative value. Type: Integer Ancestor: Rule | Optional |
| ExposeHeader | Indicates a supplemented header in CORS responses. The header provides additional information for servers. It must not contain any spaces. Type: String Ancestor: Rule | Optional |
Response Syntax
HTTP/1.1 status_code
Server: Server Name
x-amz-request-id: request id
x-amz-id-2: id
x-reserved: amazon, aws and amazon web services are trademarks or registered trademarks of Amazon Technologies, Inc
Date: date
Content-Length: 0
Response Headers
This response uses generic headers.
Response Elements
This answer contains no elements.
Error messages
No specific error messages are returned.
Example request
PUT /?cors HTTP/1.1
User-Agent: curl/7.19.0 (x86_64-suse-linux-gnu) libcurl/7.19.0 OpenSSL/0.9.8{ zlib/1.2.3 libidn/1.10
Host: bucketname.s3.example.com
Accept: */*
Date: Tue, 28 Apr 2015 08:56:07 +0000
Authorization: AWS D13E0C94E722DD69423C:QhHpU6Amg/2r6wIYdU3RXIx7Tlc=
Content-MD5: x3R4DBZgOrwsI6DwztrQCg==
Content-Length: 468
<CORSConfiguration>
<CORSRule>
<AllowedMethod>POST</AllowedMethod>
<AllowedMethod>GET</AllowedMethod>
<AllowedMethod>HEAD</AllowedMethod>
<AllowedMethod>PUT</AllowedMethod>
<AllowedMethod>DELETE</AllowedMethod>
<AllowedOrigin>s3.example.com</AllowedOrigin>
<AllowedOrigin>www.example.com</AllowedOrigin>
<AllowedHeader>AllowedHeader_1</AllowedHeader>
<AllowedHeader>AllowedHeader_2</AllowedHeader>
<MaxAgeSeconds>100</MaxAgeSeconds>
<ExposeHeader>ExposeHeader_1</ExposeHeader>
<ExposeHeader>ExposeHeader_2</ExposeHeader>
</CORSRule>
</CORSConfiguration>
Sample answer
HTTP/1.1 200 OK
Server: S3
x-amz-request-id: C2D2F581B3C5AF6C6698322AB56836F6
x-amz-id-2: lDGZAj4h+A33eYauDCTsPvFSHzBXEtZon6Eg1idIZl18/2/odotyqJUJ/lTh80uA
x-reserved: amazon, aws and amazon web services are trademarks or registered trademarks of Amazon Technologies, Inc
Date: Tue, 28 Apr 2015 08:56:07 GMT
Content-Length: 0