CORS policy Blocking

Question

Running a standard call to an s3 bucket.  boto3 is working fine. I'm not getting through on node with the aws-sdk.  CORS policy in s3 is configured such:

[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "GET"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": []
    }
]

Error: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Riku_Kobayashi · Accepted Answer

Hello.

I have seen similar errors in the past, but in that case, the error occurred when the S3 region and the region used by the Boto3 client did not match.  
Are you making the request in the correct region?  
https://stackoverflow.com/questions/63461863/response-to-preflight-request-doesnt-pass-access-control-check-no-access-cont

re:Post Agent · Answer

The CORS (Cross-Origin Resource Sharing) policy you've configured for your S3 bucket appears to be correct for allowing GET requests from any origin. However, the error message you're receiving suggests that the preflight request is failing, which is typically an OPTIONS request sent by the browser before the actual GET request to that.

To resolve this issue, you need to explicitly allow the OPTIONS method in your CORS configuration. Here's an updated CORS policy that should address the problem:

```
[
    {
        "AllowedHeaders": [
            "*"
        ],
        "AllowedMethods": [
            "GET",
            "HEAD"
        ],
        "AllowedOrigins": [
            "*"
        ],
        "ExposeHeaders": []
    }
]
```

https://docs.aws.amazon.com/AmazonS3/latest/userguide/ManageCorsUsing.html

Additionally, ensure that you're using the latest version of the AWS SDK for JavaScript in Node.js, as older versions might have issues with CORS handling.

If you're still experiencing issues after making these changes, double-check that the CORS configuration has been successfully applied to your S3 bucket and that there are no conflicting bucket policies or ACLs that might be interfering with access.

Remember that CORS is enforced by the browser, so testing with tools like curl or Postman won't reveal CORS issues. Always test in the actual browser environment where your application will run.

Lastly, if you're using Amazon CloudFront in front of your S3 bucket, ensure that it's configured to forward the necessary headers to S3 for CORS to work properly.  
**Sources**  
[Use PutBucketCors with an AWS SDK or CLI - AWS SDK Code Examples](https://docs.aws.amazon.com/code-library/latest/ug/s3_example_s3_PutBucketCors_section.html)  
[Use PutBucketCors with an AWS SDK or CLI - Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/API/s3_example_s3_PutBucketCors_section.html)

CORS policy Blocking

Add your answer

Relevant content