CORS

Cross-Origin Resource Sharing (CORS) allows you to specify which domains can make cross-origin requests to your Object Storage. CORS is beneficial when you need to serve resources from your bucket to web applications hosted on different domains.

Use cases

• Cross-Domain Image Serving: Suitable for websites that need to display images stored in the S3 buckets on the various domains without encountering cross-domain restrictions.

• Multi-Domain: Supports complex web applications that operate across multiple domains to access and use data stored in the S3 buckets seamlessly.

• Development and Testing Environment: Facilitates the access of development and staging versions of your web applications hosted on different domains to the same S3 resources. You can configure the CORS headers on the staging servers to allow requests from the development or testing domains, ensuring seamless testing without running into cross-origin restrictions.

Manage CORS

You can manage CORS using the web console, API, and CLI.

Web console

1. In the DCD, go to Menu > Storage > IONOS S3 Object Storage.

2. From the Buckets list, choose the bucket for which the CORS rule must be configured and click Bucket settings.

3. Go to the CORS setting under Access management and click Add a rule.

CORS setting

4. Enter the following details to configure the CORS rule:

• Rule name: Enter a name to identify the rule uniquely.

• Allowed origins: Enter the complete domain of the client you want to access your bucket's content from and click Add. The domain should start with a protocol identifier, such as HTTP, and end with a hostname; for example, https://*.example.com. You can add one or more origins.

• Allowed headers (Optional): Specify the non-default headers that your Object Storage bucket must accept from your client and click Add. The CORS automatically takes default headers such as Content-Length and Content-Type.

Add a CORS rule

• Allowed methods: Select the API method checkbox to allow interaction with your S3 bucket. You can enable or restrict the following API methods:

  • GET: Fetch the CORS configuration of the bucket.

  • POST: Create a new bucket.

  • PUT: Update the bucket's property or content.

  • HEAD: Retrieve the bucket's metadata.

  • DELETE: Delete a bucket.

• Expose headers (Optional): Specify the headers in the response that you want users to be able to access from their applications and click Add.

• Max age (Optional): Specify the time in seconds for how long a request’s verification is cached. The Object Storage bucket can accept more requests from the same origin while the verification is cached.

5. Click Add a rule.

Add a CORS rule

Result: The CORS rule is successfully added.

Info: Using the same CORS bucket settings, you can turn on, off, modify, and delete an existing rule. It takes up to a few minutes for the deletion of a CORS rule to propagate fully.

IONOS S3 Object Storage API

Use the CORS API to manage the CORS rules.

CLI tool

Use the CLI to manage CORS configuration.