• Object Storage Service

  1. Help Center
  2. Object Storage Service
  3. User Guide
  4. OBS Browser Operation Guide
  5. CORS
  6. Configuring CORS

Configuring CORS

This section describes how to use CORS in HTML5 to implement cross-origin access.


  1. Log in to OBS Browser.
  2. Click the blank area in the row of the bucket for which you want to configure CORS and choose More > Configure CORS Rule.
  3. Click Add.


    You can set a maximum of 100 CORS rules.

  4. In the Add CORS Rule dialog box that is displayed, as shown in Figure 1, enter CORS rules.

    Figure 1 Adding a CORS rule

    Table 1 describes parameters in CORS rules.

    Table 1 Parameters in CORS rules



    Allowed Origin

    Requests from this origin can access the bucket. This parameter is mandatory.

    Multiple matching rules are allowed. One rule occupies one line, and allows one wildcard character (*) at most. For example:



    Allowed Method

    Specifies the acceptable operation type of buckets and objects. This parameter is mandatory.

    The methods include GET, POST, PUT, DELETE, and HEAD.

    Allowed Header

    Specifies the allowed header of cross-origin requests. Only CORS requests matching the allowed header are valid.

    You can enter multiple allowed headers (one per line) and each line can contain one wildcard character (*) at most. Spaces and special characters including &:< are not allowed.

    This parameter is optional.

    Exposed Header

    Specifies the exposed header in CORS responses, providing additional information for clients.

    You can enter multiple exposed headers (one per line). Spaces and special characters including *&:< are not allowed.

    This parameter is optional.

    Cache Duration (s)

    Specifies the duration that your browser can cache CORS responses, expressed in seconds. The default value is 100.

    This parameter is optional.

  5. Click OK.
  6. In the Configure CORS Rule dialog box, click OK to save the rules.

    After CORS is successfully configured, only the addresses specified in Allowed Origin can access a bucket on OBS using the method specified in Allowed Method. For example, you configure CORS parameters of bucket testbucket as follows:

    • Allowed Originwww.examlple.com
    • Allowed MethodGET
    • Allowed Header: left blank
    • Exposed Header: left blank
    • Cache Duration (s)100

    Then, OBS only allows GET requests from origin www.examlple.com to access bucket testbucket without restricting the request headers. Your browser can cache the CORS requests for 100 seconds.

  7. In the dialog box that is displayed, click OK.