Description
The OPTIONS Object API is used to send an OPTIONS request before the CORS configuration for an object. That is, an OPTIONS request with the specific source domain, HTTP method, and header information is sent to COS before a CORS configuration request to determine whether a CORS configuration request can be sent. When the CORS configuration does not exist, a 403 Forbidden response is returned. You can call the PUT Bucket cors API to enable CORS for the bucket.
Request
Request Example
OPTIONS /<ObjectKey> HTTP/1.1
Host: <BucketName-APPID>.<Endpoint>
Date: GMT Date
Origin: Origin
Access-Control-Request-Method: HTTPMethod
Access-Control-Request-Headers: RequestHeader
Authorization: Auth String
Note:
Authorization: Auth String (For details, please refer to section Request Signature).
Request Header
Common Headers
This request uses common request headers. For details, see Public Request Headers.
Non-common Headers
| Name | Type | Description | Required |
|---|---|---|---|
| Origin | string | The domain name of the request source for simulating cross-origin access | Yes |
| Access-Control-Request-Method | string | The HTTP method for simulating cross-origin access requests. | Yes |
| Access-Control-Request-Headers | string | Request headers for simulating the cross-origin access | No |
Request Body
The request body of this request is empty.
Response
Response Headers
Common Response Headers
This response uses common response headers. For details, see Common Response Headers.
Special Response Headers
Specific response headers for this request operation are as follows:
| Name | Type | Description |
|---|---|---|
| Access-Control-Allow-Origin | string | Simulated cross-origin access request origin domain. This header is not returned when the origin is not allowed. |
| Access-Control-Allow-Methods | string | Simulated cross-origin access request HTTP method. This header is not returned when the request method is not allowed. |
| Access-Control-Allow-Headers | string | Simulated cross-origin access request headers. This header is not returned when simulating any request headers is not allowed. |
| Access-Control-Expose-Headers | string | Simulated cross-origin access request HTTP method. This header is not returned when the request method is not allowed. |
| Access-Control-Max-Age | string | Validity period of the result obtained by the OPTIONS request. |
Response Body
The response body is empty.
Practical Case
Request
OPTIONS /exampleobject HTTP/1.1
Host: <BucketName-APPID>.<Endpoint>
Date: Thu, 12 Jan 2017 17:26:53 GMT
Origin: http://www.domain.com
Access-Control-Request-Method: PUT
Authorization: q-sign-algorithm=sha1&q-ak=AKIDxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&q-sign-time=1487070734;32466654734&q-key-time=1487070734;32559966734&q-header-list=host&q-url-param-list=&q-signature=2ac3ada19910f44836ae0df72a0ec1003f34324b
Response
HTTP/1.1 200 OK
Content-Type: application/xml
Content-Length: 16087
Connection: keep-alive
x-cos-request-id: NTg3NzRiZGRfYmRjMzVfM2Y2OF81N2YzNA==
Date: Thu, 12 Jan 2017 17:26:53 GMT
ETag: \"9a4802d5c99dafe1c04da0a8e7e166bf\"
Access-Control-Allow-Origin: http://www.domain.com
Access-Control-Allow-Methods: PUT
Access-Control-Expose-Headers: x-cos-request-id