Help Center/ Object Storage Service/ API Reference/ Object APIs/ Sending an OPTIONS Request to an Object - OptionsObject
Updated on 2026-07-27 GMT+08:00
View PDF
Share

Sending an OPTIONS Request to an Object - OptionsObject

Function

An OPTIONS request to an object is a CORS preflight request used to check whether OBS allows the actual cross-origin request. Before sending an OPTIONS request to an object, you need to configure CORS rules for the bucket. For details about CORS, see Configuring CORS for a Bucket.

Differences Between OptionsObject and OptionsBucket

With OptionsObject, you need to specify an object name in the URL to check the cross-origin access permission for a specific object. With OptionsBucket, you do not need to do so because the bucket domain name is specified in the URL, meaning that the cross-origin access permission for the entire bucket is checked. The request lines of the two methods are as follows:

OPTIONS /object HTTP/1.1
OPTIONS / HTTP/1.1

URI

OPTIONS /{object_key}

Calling Method

For details, see Calling APIs. Before calling this API, calculate the API signature and add it to the request.

You can debug this API in API Explorer.

Request Syntax

1
2
3
4
5
6
 
OPTIONS /object HTTP/1.1 
Host: bucketname.obs.region.myhuaweicloud.com 
Date: date
Authorization: authorization
Origin: origin
Access-Control-Request-Method: method

The Authorization header is required when API Explorer or curl is used for debugging, but is not required for CORS preflight requests initiated by browsers.

URI Parameters

This request contains no URI parameters.

Request Headers

This request contains the headers described in Table 1.

Table 1 OPTIONS request headers

Header

Mandatory

Type

Description

Origin

Yes

String

Definition

Origin specified in the CORS preflight request. It is usually a domain name.

Constraints

This value cannot be empty.

Range

The value must be in a valid domain name format.

Default Value

N/A

Access-Control-Request-Method

Yes

String

Definition

HTTP method allowed in the request. Multiple methods are allowed.

Constraints

This value cannot be empty.

Range

GET: Retrieve

PUT: Write or modify

HEAD: Query information

POST: Write or modify

DELETE: Remove

Default Value

N/A

Access-Control-Request-Headers

No

String

Definition

HTTP header allowed in the request. Multiple headers are allowed.

Constraints

A request can include multiple HTTP headers.

Range

HTTP header names

Default Value

N/A

Request Body

This request contains no request body parameters.

Response Syntax

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
 
HTTP/1.1 status_code
Content-Type: type
Access-Control-Allow-Origin: origin
Access-Control-Allow-Methods: method
Access-Control-Allow-Headers: header
Access-Control-Max-Age: time
Access-Control-Expose-Headers: header
Access-Control-Allow-Credentials: credentials
Date: date
Content-Length: length

Response Headers

This response contains the headers described in Table 2.

Table 2 CORS response headers

Header

Type

Description

Access-Control-Allow-Origin

String

Definition

If the request's origin matches the server's CORS configuration, the response will include this origin.

Range

N/A

Access-Control-Allow-Headers

String

Definition

If the request headers match the server's CORS configuration, the response will include these headers.

Range

Headers allowed in the CORS configuration.

Access-Control-Max-Age

Integer

Definition

Value of MaxAgeSeconds in the server's CORS configuration.

Range

Positive integer, in seconds

Access-Control-Allow-Methods

String

Definition

If the request's Access-Control-Request-Method matches the server's CORS configuration, the response includes the methods in the rule.

Range

GET: Retrieve

PUT: Write or modify

HEAD: Query information

POST: Write or modify

DELETE: Remove

Access-Control-Expose-Headers

String

Definition

Value of ExposeHeader in the server's CORS configuration.

Range

Custom response headers

Access-Control-Allow-Credentials

String

Definition

Whether to allow frontend requests to include and expose user identity credentials (such as cookies, HTTP authentication information, or client SSL certificates) to cross-origin servers.

Range

true: Credentials can be included.

false: Credentials cannot be included.

Response Body

This response contains no elements.

Error Responses

Table 3 describes possible special errors in the request.

Table 3 Special errors

Error Code

Description

HTTP Status Code

Bad Request

Invalid Access-Control-Request-Method: null

When CORS and OPTIONS are configured for an object, no method header is added.

400 BadRequest

Bad Request

Insufficient information. Origin request header needed.

When CORS and OPTIONS are configured for an object, no origin header is added.

400 BadRequest

AccessForbidden

CORSResponse: This CORS request is not allowed. This is usually because the evaluation of Origin, request method / Access-Control-Request-Method or Access-Control-Request-Headers are not whitelisted by the resource's CORS spec.

When CORS and OPTIONS are configured for an object, origin, method, and headers do not match any rule.

403 Forbidden

Refer to Error Code Overview for all other errors.

Sample Request

1
2
3
4
5
6
7
8
 
OPTIONS /object_1 HTTP/1.1
User-Agent: curl/7.29.0
Host: examplebucket.obs.region.myhuaweicloud.com
Accept: */*
Date: Wed, 01 Jul 2015 04:02:19 GMT
Authorization: OBS H4IPJX0TQTHTHEBQQCEC:bQZG9c2aokAJsHOOkuVBK6cHZZQ=
Origin: www.example.com
Access-Control-Request-Method: PUT

Sample Response

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
 
HTTP/1.1 200 OK
Server: OBS
x-obs-request-id: BF26000001643632D12EFCE1C1294555
Access-Control-Allow-Origin: www.example.com
Access-Control-Allow-Methods: POST,GET,HEAD,PUT,DELETE
Access-Control-Max-Age: 100
Access-Control-Expose-Headers: ExposeHeader_1,ExposeHeader_2
Access-Control-Allow-Credentials: true
x-obs-id-2: 32AAAQAAEAABAAAQAAEAABAAAQAAEAABCS+DXV4zZetbTqFehhEcuXywTa/mi3T3
Date: Wed, 01 Jul 2015 04:02:19 GMT
Content-Length: 0
Parent Topic: Object APIs