Resolve cross-origin issues in OSS

Problem description

This topic describes how to troubleshoot cross-origin issues that occur when you use Object Storage Service (OSS).

No 'Access-Control-Allow-Origin' header is present on the requested resource

Solutions

1. To rule out console configuration issues, first set the cross-origin resource sharing (CORS) rule to the most permissive level, as shown in the following figure. Then, check whether the issue is resolved.

2. If the issue persists, log on to any server and run the following command to view the cross-origin request header.

   curl -voa '[$URL1]' -H 'Origin:[$URL2]'

   Note

   Note:

   • [$URL1] is the URL of the requested OSS resource.

   • [$URL2] is the source URL that you configured for the CORS rule.

   The system displays output similar to the following.

   • If the response contains one cross-origin header that matches your configured header, the issue is likely a cache problem. This can happen if your first request did not trigger a cross-origin check and the response was cached. A subsequent cross-origin request might then use the cached data instead of contacting the server, which causes the check to fail. You can try the following solutions:

     • In your browser, press Ctrl+F5 to clear the browser cache. Then, test whether the cross-origin issue persists.

     • Set the caching time of the CORS configuration for the OSS resource to 0. This prevents the resource from being cached on the client. Each request must then retrieve authentication information from the server.

     • Use Alibaba Cloud CDN to accelerate OSS. For more information, see Configure cross-origin resource sharing (CORS) using HTTP headers in Alibaba Cloud CDN. This ensures that all requests to Alibaba Cloud CDN return a CORS header.

   • If the response contains two cross-origin headers or a header that does not match your CORS configuration in OSS, the issue may be caused using Alibaba Cloud CDN to accelerate OSS. Perform the following steps:

     1. Log on to the Alibaba Cloud CDN console. Temporarily disable CDN acceleration for OSS and confirm that the cross-origin issue is resolved.

     2. After you confirm that the issue is resolved, click the specific domain name, and then choose Cache Configuration > Custom HTTP Header.

     3. Set a custom HTTP header as required. For more information, see Configure cross-origin resource sharing (CORS) using HTTP headers in Alibaba Cloud CDN.

References

If the cross-origin issue persists, see the following documents:

• If an error persists when you call OSS after you configure a CORS rule, see OSS reports the "No 'Access-Control-Allow-Origin'" error.

• For information about common errors and solutions for CORS in OSS, see Common errors and solutions for cross-origin resource sharing (CORS) in OSS.

• For an overview and configuration of CORS, see Configure cross-origin resource sharing.

Applicable to

• Object Storage Service (OSS)