AWS S3 / EC2: Downloading file with file-saver giving CORS error

0

I am using AWS S3 to host my website and set my bucket with the follow CORS settings:

<?xml version="1.0" encoding="UTF-8"?> <CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> <CORSRule> <AllowedOrigin>*</AllowedOrigin> <AllowedMethod>GET</AllowedMethod> <AllowedMethod>PUT</AllowedMethod> <AllowedMethod>POST</AllowedMethod> <AllowedMethod>DELETE</AllowedMethod> <AllowedMethod>HEAD</AllowedMethod> <MaxAgeSeconds>3000</MaxAgeSeconds> <AllowedHeader>*</AllowedHeader> </CORSRule> </CORSConfiguration> When I try to download a file saved on my EC2 instance with the Javascript Library File-Saver, I get the following error:

Access to XMLHttpRequest at 'EC2-Instance' from origin 'S3-Bucket' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
The line that is causing the error from File-Saver is:

function d(a) {
var b = new XMLHttpRequest();
return b.open("HEAD", a, !1), b.send(), 200 <= b.status && 299 >= b.status; <-- This line
}
When I simulate the request in curl with verbose on, I get the following info:

< Access-Control-Allow-Origin: *
< Access-Control-Allow-Methods: GET, PUT, POST, DELETE, HEAD
< Access-Control-Max-Age: 3000
< Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Any idea why I am still getting this error?

EDIT:

I tried the following request to see header details:

curl -H "Access-Control-Request-Method: GET" -H "Origin: S3 Bucket" --head -IXHEAD EC2_Instance
And am getting the following info without CORS info for some reason:

HTTP/1.1 200 OK
Server: nginx/1.15.8
Date: Sun, 24 Feb 2019 04:38:20 GMT
Content-Type: application/octet-stream
Content-Length: 6950
Last-Modified: Sat, 23 Feb 2019 22:35:01 GMT
Connection: keep-alive
ETag: "5c71ca95-1b26"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Cache-Control: private
Accept-Ranges: bytes

gefragt vor 5 Jahren602 Aufrufe
1 Antwort
0
Akzeptierte Antwort

S3 not send the 'Access-Control-Allow-Origin' header if the wildcard * like there:

<AllowedOrigin>*</AllowedOrigin>
Force s3 to send AllowedOrigin header and your content be loaded from any site, try this:

<AllowedOrigin>http://</AllowedOrigin>
<AllowedOrigin>https://
</AllowedOrigin>
i think one will work ..!

beantwortet vor 5 Jahren

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen