0034-00000012

Problem description

The AllowedHeader parameter of a cross-origin resource sharing (CORS) rule in the XML CORS configuration is invalid.

Causes

The AllowedHeader parameter of a CORS rule in the XML request body of the PutBucketCors operation is set to an invalid value.

Examples

For example, you initiate the following request:

PUT /?cors HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Content-Length: 186
Date: Fri, 04 May 2012 03:21:12 GMT
Authorization: OSS qn6q**************:77Dv****************
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration>
    <CORSRule>
    	<AllowedOrigin>*</AllowedOrigin>
      <AllowedMethod>GET</AllowedMethod>
      <AllowedHeader>A&B</AllowedHeader>
    </CORSRule>
    <ResponseVary>true</ResponseVary>
</CORSConfiguration>

AllowedHeader specifies whether the headers specified by Access-Control-Request-Headers in the OPTIONS preflight request are allowed. Each header specified by Access-Control-Request-Headers must match the value of an AllowedHeader element.

You can use only one asterisk (*) as the wildcard in AllowedHeader. The following characters are not supported: < > & ' " The error is returned for the sample request because the AllowedHeader parameter in the CORSRule element of the XML configuration in the sample request is set to A&B, which includes the disallowed character: &.

Solutions

Make sure that the value of the AllowedHeader parameter in the XML request body of the PutBucketCors operation is valid.

PUT /?cors HTTP/1.1
Host: oss-example.oss-cn-hangzhou.aliyuncs.com
Content-Length: 186
Date: Fri, 04 May 2012 03:21:12 GMT
Authorization: OSS qn6q**************:77Dv****************
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration>
    <CORSRule>
      <AllowedOrigin>*</AllowedOrigin>
      <AllowedMethod>GET</AllowedMethod>
      <AllowedHeader>Authorization</AllowedHeader>
    </CORSRule>
    <ResponseVary>false</ResponseVary>
</CORSConfiguration>

References

• CORS

• Introduction