Updated on 2023-04-26 GMT+08:00

Configuring CORS

This section describes how to use CORS in HTML5 to implement cross-origin access.


Static website hosting has been configured. For details, see Configuring Static Website Hosting.


  1. In the navigation pane of OBS Console, choose Object Storage.
  2. In the bucket list, click the bucket name you want. The Objects page is displayed.
  3. In the navigation pane, choose Overview.
  4. On the right of the Overview page, click CORS Rules in the Basic Configurations area. The CORS Rules page is displayed.

    Alternatively, you can choose Permissions > CORS Rules in the navigation pane.

  5. Click Create. The Create CORS Rule dialog box is displayed. See Figure 1 for details.

    You can set a maximum of 100 CORS rules for one bucket.

    Figure 1 Creating a CORS rule

  6. In the CORS Rule dialog box, configure Allowed Origin, Allowed Method, Allowed Header, Exposed Header, and Cache Duration (s).

    If CDN acceleration is enabled for the bucket, HTTP header must be configured on CDN. For details, see HTTP Header Settings.

    Table 1 Parameters in CORS rules



    Allowed Origin


    Requests from this origin can access the bucket.

    Multiple matching rules are allowed. One rule occupies one line, and allows one wildcard character (*) at most. Example:


    Allowed Method


    Specifies the acceptable operation type of buckets and objects.

    The methods include Get, Post, Put, Delete, and Head.

    Allowed Header


    Specifies the allowed header of cross-origin requests.

    Only CORS requests matching the allowed header are valid.

    You can enter multiple allowed headers (one per line) and each line can contain one wildcard character (*) at most. Spaces and special characters including &:< are not allowed.

    Exposed Header


    Specifies the exposed header in CORS responses, providing additional information for clients.

    By default, a browser can access only headers Content-Length and Content-Type. If the browser wants to access other headers, you need to configure those headers in this parameter.

    You can enter multiple exposed headers (one per line). Spaces and special characters including *&:< are not allowed.

    Cache Duration (s)


    Specifies the duration that your browser can cache CORS responses, expressed in seconds. The default value is 100.

  7. Click OK.

    Message "The CORS rule created successfully." is displayed. The configuration of CORS takes effect within two minutes.

    After CORS is successfully configured, only the addresses specified in Allowed Origin can access a bucket in OBS using the methods specified in Allowed Method. For example, you can configure CORS parameters for bucket testbucket as follows:

    • Allowed Origin: https://www.example.com
    • Allowed Method: GET
    • Allowed Header: *
    • Exposed Header: *
    • Cache Duration (s): 100

    By doing so, OBS only allows GET requests from https://www.example.com to access bucket testbucket, without restrictions on request headers. The client can cache CORS responses for 100 seconds.