Help Center/ Object Storage Service/ API Reference/ Bucket APIs/ Sending an OPTIONS Request to a Bucket - OptionsBucket
Updated on 2026-07-27 GMT+08:00

Sending an OPTIONS Request to a Bucket - OptionsBucket

Function

Browsers automatically send OPTIONS requests (preflight requests) before cross-origin calls to verify whether the clients have required permissions to perform operations on servers. Subsequent requests are executed only after preflight requests are successful.

OBS allows static web resources to be stored in buckets with appropriate configurations. In this scenario, buckets in the OBS serve as servers to process OPTIONS preflight requests from clients.

Constraints

OBS can process OPTIONS preflight requests only after CORS is configured for desired buckets in OBS. Otherwise, a 403 Forbidden error will be returned for OPTIONS requests. For details about how to configure CORS, see Configuring CORS for a Bucket.

Differences Between OPTIONS Bucket and OPTIONS Object

With the OPTIONS Object, you need to specify an object name in the URL, but an object name is not required with the OPTIONS Bucket, which uses the bucket domain name as the URL. The request lines of the two methods are as follows:

OPTIONS /object HTTP/1.1
OPTIONS / HTTP/1.1

URI

OPTIONS /

Calling Method

For details, see Calling APIs. Before calling this API, calculate the API signature and add it to the request.

You can debug this API in API Explorer.

Request Syntax

1
2
3
4
5
6
OPTIONS / HTTP/1.1 
Host: bucketname.obs.region.myhuaweicloud.com 
Date: date
Authorization: authorization
Origin: origin
Access-Control-Request-Method: method

The Authorization header is required when API Explorer or curl is used for debugging, but is not required for CORS preflight requests initiated by browsers.

URI Parameters

This request contains no URI parameters.

Request Headers

This request contains the headers described in Table 1.

Table 1 OPTIONS request headers

Header

Mandatory

Type

Description

Origin

Yes

String

Definition

Origin specified in the CORS preflight request. It is usually a domain name.

Constraints

This value cannot be empty.

Range

The value must be in a valid domain name format.

Default Value

N/A

Access-Control-Request-Method

Yes

String

Definition

HTTP method allowed in the request. Multiple methods are allowed.

Constraints

Valid HTTP methods.

Range

GET: Retrieve

PUT: Write or modify

HEAD: Query information

POST: Write or modify

DELETE: Remove

Default Value

N/A

Access-Control-Request-Headers

No

String

Definition

HTTP header allowed in the request. Multiple headers are allowed.

Constraints

A request can include multiple HTTP headers.

Range

HTTP header names.

Default Value

N/A

Request Body

This request contains no request body parameters.

Response Syntax

1
2
3
4
5
6
7
8
9
HTTP/1.1 status_code
Access-Control-Allow-Origin: origin
Access-Control-Allow-Methods: method
Access-Control-Allow-Headers: header
Access-Control-Max-Age: time
Access-Control-Expose-Headers: header
Access-Control-Allow-Credentials: credentials
Date: date
Content-Length: length

Response Headers

This response contains the headers described in Table 2.

Table 2 CORS response headers

Header

Type

Description

Access-Control-Allow-Origin

String

Definition

If the request's origin matches the server's CORS configuration, the response will include this origin.

Range

Origins allowed in the CORS configuration.

Access-Control-Allow-Headers

String

Definition

If the request headers match the server's CORS configuration, the response will include these headers.

Range

Headers allowed in the CORS configuration.

Access-Control-Max-Age

Integer

Definition

Value of MaxAgeSeconds in the server's CORS configuration.

Range

Positive integer, in seconds

Access-Control-Allow-Methods

String

Definition

If the request's Access-Control-Request-Method matches the server's CORS configuration, the response includes the methods in the rule.

Range

GET: Retrieve

PUT: Write or modify

HEAD: Query information

POST: Write or modify

DELETE: Remove

Access-Control-Expose-Headers

String

Definition

Value of ExposeHeader in the server's CORS configuration.

Range

Custom response headers

Response Body

This response contains no elements.

Error Responses

Table 3 describes possible special errors in this request.

Table 3 Special errors

Error Code

Description

HTTP Status Code

Bad Request

Invalid Access-Control-Request-Method: null

When CORS and OPTIONS are configured for a bucket, no method header is added.

400 BadRequest

Bad Request

Insufficient information. Origin request header needed.

When CORS and OPTIONS are configured for a bucket, no origin header is added.

400 BadRequest

AccessForbidden

CORSResponse: This CORS request is not allowed. This is usually because the evaluation of Origin, request method / Access-Control-Request-Method or Access-Control-Request-Headers are not whitelisted by the resource's CORS spec.

When CORS and OPTIONS are configured for a bucket, origin, method, and headers do not match any rule.

403 Forbidden

Refer to Error Code Overview for all other errors.

Sample Request

1
2
3
4
5
6
7
8
OPTIONS / HTTP/1.1
User-Agent: curl/7.29.0
Host: examplebucket.obs.region.myhuaweicloud.com
Accept: */*
Date: Wed, 01 Jul 2015 04:02:15 GMT
Authorization: OBS H4IPJX0TQTHTHEBQQCEC:7RqP1vjemo6U+Adv9/Y6eGzWrzA=
Origin: www.example.com
Access-Control-Request-Method: PUT

Sample Response

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
HTTP/1.1 200 OK
Server: OBS
x-obs-request-id: BF260000016436314E8FF936946DBC9C
Access-Control-Allow-Origin: www.example.com
Access-Control-Allow-Methods: POST,GET,HEAD,PUT,DELETE
Access-Control-Max-Age: 100
Access-Control-Expose-Headers: ExposeHeader_1,ExposeHeader_2
Access-Control-Allow-Credentials: true
x-obs-id-2: 32AAAQAAEAABAAAQAAEAABAAAQAAEAABCTlYimJvOyJncCLNm5y/iz6MAGLNxTuS
Date: Wed, 01 Jul 2015 04:02:15 GMT
Content-Length: 0

Helpful Links