Updated on 2026-09-22 GMT+08:00

Setting CORS Rules

You can call setBucketCORS to set CORS rules for a bucket. If the bucket is configured with CORS rules, the newly set ones will overwrite the existing ones.

Sample code is as follows:

static OBSClient *client;
NSString *endPoint = @"https://your-endpoint";
// Hard-coded or plaintext AK and SK are risky. For security purposes, encrypt your AK and SK before storing them in the configuration file or environment variables. In this example, the AK and SK are stored in environment variables. Before running the code in this example, configure environment variables AccessKeyID and SecretAccessKey.
// Obtain an AK/SK pair on the management console. For details, see https://support.huaweicloud.com/intl/en-us/usermanual-ca/ca_01_0003.html.
char* ak_env = getenv("AccessKeyID");
char* sk_env = getenv("SecretAccessKey");
if (ak_env == NULL || sk_env == NULL) {
    NSLog(@"Error: AccessKeyID or SecretAccessKey environment variable not set");
    return;
}
NSString *AK = [NSString stringWithUTF8String:ak_env];
NSString *SK = [NSString stringWithUTF8String:sk_env];
    
// Initialize identity authentication.
OBSStaticCredentialProvider *credentialProvider = [[OBSStaticCredentialProvider alloc] initWithAccessKey:AK secretKey:SK];
    
//Initialize service configuration.
OBSServiceConfiguration *conf = [[OBSServiceConfiguration alloc] initWithURLString:endPoint credentialProvider:credentialProvider];
    
// Initialize an instance of OBSClient.
client = [[OBSClient alloc] initWithConfiguration:conf];
    
// Set CORS rules for a bucket.
    
OBSSetBucketCORSRequest *request = [[OBSSetBucketCORSRequest alloc] initWithBucketName:@"bucketname"];
OBSCORSRule* rule = [OBSCORSRule new];
// Specify the request method, which can be GET, PUT, DELETE, POST, or HEAD.
rule.allowedMethodList = @[OBSCORSHTTPGET,OBSCORSHTTPPUT,OBSCORSHTTPPOST,OBSCORSHTTPHEAD];
// Specify the origin of the cross-origin request.
rule.allowedOriginList = @[@"www.example1.com",@"www.example2.com"];
// Set the allowed headers.
rule.allowedHeaderList = @[@"allowedheader1",@"allowedheader2"];
// Specify response headers that users can access using application programs.
rule.exposeHeaderList = @[@"exposeheader_1",@"exposeheader_2"];
// Specify the browser's cache time of the returned results of OPTIONS requests for specific resources, in seconds.
rule.maxAgeSeconds = [NSNumber numberWithInt:100];
[request.bucketCORSRuleList addObject:rule];
[client setBucketCORS:request completionHandler:^(OBSSetBucketCORSResponse *response, NSError *error) {
    NSLog(@"%@",response);
 }];