Setting CORS Configuration

Last Updated At: 2025-10-21 09:10:00

Description

The PUT Bucket API is used to configure CORS for a bucket. You need to pass in an XML configuration file within 64 KB. By default, the owner of the bucket has the permission to access the API, and can grant permissions to other users.

Request

Request sample:

PUT /?cors HTTP/1.1
Host: <BucketName-APPID>.<Endpoint>
Date: GMT Date
Content-Length: length
Content-Type: application/xml
Content-MD5: MD5
Authorization: Auth String

<XML file>

Note:

Authorization: Auth String (See Request Signature for details.)

Request Line

PUT /?cors HTTP/1.1

This API accepts PUT requests.

Request Header

Common Headers

This request uses common request headers. For details, see Common Request Headers.

Non-common Headers

This request has no special request header information.

Request Body

The request body is a CORS rule.

<?xml version="1.0" encoding="UTF-8" ?>
<CORSConfiguration>
  <CORSRule>
    <ID>string</ID>
    <AllowedOrigin>string</AllowedOrigin>
    <AllowedMethod>string</AllowedMethod>
    <AllowedHeader>string</AllowedHeader>
    <MaxAgeSeconds>0</MaxAgeSeconds>
    <ExposeHeader>string</ExposeHeader>
  </CORSRule>
</CORSConfiguration>

The data are described as follows:

Node Name (Keyword) Parent Node Description Type Required
CORSConfiguration No All information about CORS rule. You can configure up to 100 CORSRule. Container Yes

Content of CORSConfiguration:

Node Name (Keyword) Parent Node Description Type Required
CORSRule CORSConfiguration All information about CORS rule. You can configure up to 100 CORSRule. Container Yes

Content of CORSRule:

Node Name (Keyword) Parent Node Description Type Required
ID CORSConfiguration.CORSRule ID of the CORSRule, not required. string Yes
AllowedOrigin CORSConfiguration.CORSRule Allowed access sources. The wildcard * is supported. Format: protocol://domain name[:port], such as, http://www.test.com. strings Yes
AllowedMethod CORSConfiguration.CORSRule Allowed HTTP operations. Enumerated values: GET, PUT, HEAD, POST, and DELETE strings Yes
AllowedHeader CORSConfiguration.CORSRule When an OPTIONS request is sent, the browser will let the server know what custom HTTP headers will be used in the actual request. You can set it to * to allow all domains. strings Yes
MaxAgeSeconds CORSConfiguration.CORSRule Validity period of the result obtained by the OPTIONS request. integer Yes
ExposeHeader CORSConfiguration.CORSRule User-defined header information from the server side that the browser can receive. strings Yes

Response

Response Headers

Common Response Headers

This response uses common response headers. For details, see Public Response Header.

Special Response Headers

This request has no special response header information.

Response Body

The response body is empty.

Error Code

Error Code Description HTTP Status Code
SignatureDoesNotMatch If this error code is returned, it means the provided signature is incorrect. 403 Forbidden
NoSuchBucket If this error code is returned, it means the bucket you want to add the rule to is not found. 404 Not Found

Practical Case

Request

PUT /?cors HTTP/1.1
Host: <BucketName-APPID>.<Endpoint>
Date: Fri, 10 Mar 2017 09:45:46 GMT
Authorization: q-sign-algorithm=sha1&q-ak=AKIDxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&q-sign-time=1484814927;32557710927&q-key-time=1484814927;32557710927&q-header-list=host&q-url-param-list=cors&q-signature=8b9f05dabce2578f3a79d732386e7cbade9033e3
Content-Type: application/xml
Content-Length: 280

<CORSConfiguration>
    <CORSRule>
        <ID>1234</ID>
        <AllowedOrigin>http: //www.test.com</AllowedOrigin>
        <AllowedMethod>PUT</AllowedMethod>
        <AllowedHeader>x-cos-meta-test</AllowedHeader>
        <MaxAgeSeconds>500</MaxAgeSeconds>
        <ExposeHeader>x-cos-meta-test1</ExposeHeader>
    </CORSRule>
</CORSConfiguration>

Response

HTTP/1.1 200 OK
Content-Type: application/xml
Content-Length: 0
Connection: keep-alive
Date: Fri, 10 Mar 2017 09:45:46 GMT
x-cos-request-id: NTg4MDdiZWRfOWExZjRlXzQ2OWVfZGY0