CORS Headers

Configure Cross-Origin Resource Sharing (CORS) headers to control which browser origins can send requests to a Stook Bucket.

CORS is a browser security mechanism. When JavaScript on a web page requests a resource from a different origin, the browser allows the request only when the target origin permits it.

CORS affects JavaScript requests made by web browsers. It does not affect:

• Files loaded through HTML elements such as <img> or <video>

• S3-compatible SDKs used outside a browser

• AWS CLI requests

• Server-side applications

CORS does not grant access to objects in a Stook Bucket. It only determines whether a browser can send a cross-origin request. The request still requires valid credentials or a pre-signed URL unless the Stook Bucket has Public access enabled.

For complete request parameters, response schemas, and error responses, see Bucket Settings API.

How CORS Headers Work

When CORS Headers is enabled, the Stook Bucket accepts cross-origin browser requests from the origins configured under Allowed origins.

New Stook Buckets have CORS headers enabled by default with * as the allowed origin.

The following HTTP methods are supported for allowed origins:

• DELETE

• GET

• HEAD

• POST

• PUT

Requests can include any request headers. JavaScript can access the following response headers:

• Content-Length

• Content-Type

• ETag

• x-amz-request-id

When CORS headers are disabled, browsers block cross-origin requests to the Stook Bucket.

Allowed Origins

Add each origin that should be allowed to send browser requests to the Stook Bucket.

Supported formats include:

• An exact origin, such as https://example.com

• All subdomains of a domain, such as *.example.com

• * to allow requests from any origin

For exact origins, include the scheme, such as https://. The configured origin must match the origin sent by the browser.

Use lowercase domain names. localhost and IP addresses are not accepted as origins.

You can configure up to 100 origins.

If Allowed origins contains *, it takes precedence over all other entries. Additional origins in the list are ignored.

Configure CORS Headers

1

Open the Stook Bucket

In the Medianova Control Panel, select Stook Object Storage → Buckets, then select the Stook Bucket you want to configure.

2

Open CORS Headers

On the Bucket configuration page, select CORS headers.

3

Enable CORS Headers

Turn on Enabled.

4

Add allowed origins

Enter an origin in Allowed origins, then select Add.

Repeat this step for each origin you want to allow. To remove an origin, select the remove icon next to it.

5

Save the configuration

Select Save Changes.

Configuration Fields

Field	Description	Default
Enabled	Enables or disables CORS headers for the Stook Bucket.	On
Allowed origins	Specifies the browser origins that can send cross-origin requests to the Stook Bucket. Supports up to 100 origins.	*

Configure CORS Headers with the API

Use the bucket settings endpoint to configure CORS headers:

PATCH /api/v2/stook/{organization_uuid}/bucket/{bucket_uuid}/settings

Send:

{
  "status_cors_header": "on",
  "cors_domains": [
    "https://example.com",
    "*.example.com"
  ]
}

The request enables CORS headers and allows browser requests from the specified origins.

To disable CORS headers, send:

{
  "status_cors_header": "off"
}

Troubleshooting

More than 100 origins are configured

A Stook Bucket supports up to 100 CORS origins.

Remove unnecessary origins or use a subdomain wildcard such as *.example.com to cover multiple origins.

An origin is not accepted

Confirm that the origin uses a supported format, such as:

https://example.com

or:

*.example.com

Use lowercase domain names. localhost and IP addresses are not supported.

The browser reports a CORS error

Confirm that:

• CORS Headers is enabled.

• The web page's origin is included in Allowed origins.

• The configured origin matches the origin sent by the browser, including the scheme and port.

If you recently changed the configuration, clear the browser cache or wait for the cached CORS response to expire.

Related Topics

• Bucket Configuration

• Public Access Block

• Manage Access Keys