> For the complete documentation index, see [llms.txt](https://clients.medianova.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://clients.medianova.com/products/object-storage-stook/bucket-configuration/cors-headers.md).

# CORS Headers

Configure Cross-Origin Resource Sharing (CORS) headers to control which browser origins can send requests to a Stook Bucket.

CORS is a browser security mechanism. When JavaScript on a web page requests a resource from a different origin, the browser allows the request only when the target origin permits it.

CORS affects JavaScript requests made by web browsers. It does not affect:

* Files loaded through HTML elements such as `<img>` or `<video>`
* S3-compatible SDKs used outside a browser
* AWS CLI requests
* Server-side applications

{% hint style="info" %}
CORS does not grant access to objects in a Stook Bucket. It only determines whether a browser can send a cross-origin request. The request still requires valid credentials or a pre-signed URL unless the Stook Bucket has **Public access** enabled.
{% endhint %}

{% hint style="info" %}
For complete request parameters, response schemas, and error responses, see [Bucket Settings API](/api-documentation/object-storage-stook/buckets/settings.md).
{% endhint %}

## How CORS Headers Work

When **CORS Headers** is enabled, the Stook Bucket accepts cross-origin browser requests from the origins configured under **Allowed origins**.

New Stook Buckets have CORS headers enabled by default with `*` as the allowed origin.

The following HTTP methods are supported for allowed origins:

* `DELETE`
* `GET`
* `HEAD`
* `POST`
* `PUT`

Requests can include any request headers. JavaScript can access the following response headers:

* `Content-Length`
* `Content-Type`
* `ETag`
* `x-amz-request-id`

When CORS headers are disabled, browsers block cross-origin requests to the Stook Bucket.

## Allowed Origins

Add each origin that should be allowed to send browser requests to the Stook Bucket.

Supported formats include:

* An exact origin, such as `https://example.com`
* All subdomains of a domain, such as `*.example.com`
* `*` to allow requests from any origin

For exact origins, include the scheme, such as `https://`. The configured origin must match the origin sent by the browser.

Use lowercase domain names. `localhost` and IP addresses are not accepted as origins.

You can configure up to 100 origins.

{% hint style="info" %}
If **Allowed origins** contains `*`, it takes precedence over all other entries. Additional origins in the list are ignored.
{% endhint %}

## Configure CORS Headers

{% stepper %}
{% step %}

### **Open the Stook Bucket**

In the [Medianova Control Panel](https://cloud.medianova.com), select **Stook Object Storage → Buckets**, then select the Stook Bucket you want to configure.
{% endstep %}

{% step %}

### **Open CORS Headers**

On the **Bucket configuration** page, select **CORS headers**.

<figure><img src="https://542970813-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtK7oIwmhUHdEJcaH4Hx8%2Fuploads%2Fe2BelNp5mHIWv7N2waas%2Fimage.png?alt=media&amp;token=15ca3dde-d274-4752-91c9-40a383b3e155" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### **Enable CORS Headers**

Turn on **Enabled**.
{% endstep %}

{% step %}

### **Add allowed origins**

Enter an origin in **Allowed origins**, then select **Add**.

Repeat this step for each origin you want to allow. To remove an origin, select the remove icon next to it.
{% endstep %}

{% step %}

### **Save the configuration**

Select **Save Changes**.
{% endstep %}
{% endstepper %}

## Configuration Fields

<table><thead><tr><th width="164">Field</th><th width="483.5999755859375">Description</th><th>Default</th></tr></thead><tbody><tr><td><strong>Enabled</strong></td><td>Enables or disables CORS headers for the Stook Bucket.</td><td>On</td></tr><tr><td><strong>Allowed origins</strong></td><td>Specifies the browser origins that can send cross-origin requests to the Stook Bucket. Supports up to 100 origins.</td><td><code>*</code></td></tr></tbody></table>

## Configure CORS Headers with the API

Use the bucket settings endpoint to configure CORS headers:

```http
PATCH /api/v2/stook/{organization_uuid}/bucket/{bucket_uuid}/settings
```

Send:

```json
{
  "status_cors_header": "on",
  "cors_domains": [
    "https://example.com",
    "*.example.com"
  ]
}
```

The request enables CORS headers and allows browser requests from the specified origins.

To disable CORS headers, send:

```json
{
  "status_cors_header": "off"
}
```

## Troubleshooting

### More than 100 origins are configured

A Stook Bucket supports up to 100 CORS origins.

Remove unnecessary origins or use a subdomain wildcard such as `*.example.com` to cover multiple origins.

### An origin is not accepted

Confirm that the origin uses a supported format, such as:

```
https://example.com
```

or:

```
*.example.com
```

Use lowercase domain names. `localhost` and IP addresses are not supported.

### The browser reports a CORS error

Confirm that:

* **CORS Headers** is enabled.
* The web page's origin is included in **Allowed origins**.
* The configured origin matches the origin sent by the browser, including the scheme and port.

If you recently changed the configuration, clear the browser cache or wait for the cached CORS response to expire.

## Related Topics

* [Bucket Configuration](/products/object-storage-stook/bucket-configuration.md)
* [Public Access Block](/products/object-storage-stook/bucket-configuration/public-access-block.md)
* [Manage Access Keys](/products/object-storage-stook/manage-access-keys.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://clients.medianova.com/products/object-storage-stook/bucket-configuration/cors-headers.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.