AWS S3 / EC2: Downloading file with file-saver giving CORS error

0

I am using AWS S3 to host my website and set my bucket with the follow CORS settings:

<?xml version="1.0" encoding="UTF-8"?> <CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> <CORSRule> <AllowedOrigin>*</AllowedOrigin> <AllowedMethod>GET</AllowedMethod> <AllowedMethod>PUT</AllowedMethod> <AllowedMethod>POST</AllowedMethod> <AllowedMethod>DELETE</AllowedMethod> <AllowedMethod>HEAD</AllowedMethod> <MaxAgeSeconds>3000</MaxAgeSeconds> <AllowedHeader>*</AllowedHeader> </CORSRule> </CORSConfiguration> When I try to download a file saved on my EC2 instance with the Javascript Library File-Saver, I get the following error:

Access to XMLHttpRequest at 'EC2-Instance' from origin 'S3-Bucket' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
The line that is causing the error from File-Saver is:

function d(a) {
var b = new XMLHttpRequest();
return b.open("HEAD", a, !1), b.send(), 200 <= b.status && 299 >= b.status; <-- This line
}
When I simulate the request in curl with verbose on, I get the following info:

< Access-Control-Allow-Origin: *
< Access-Control-Allow-Methods: GET, PUT, POST, DELETE, HEAD
< Access-Control-Max-Age: 3000
< Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Any idea why I am still getting this error?

EDIT:

I tried the following request to see header details:

curl -H "Access-Control-Request-Method: GET" -H "Origin: S3 Bucket" --head -IXHEAD EC2_Instance
And am getting the following info without CORS info for some reason:

HTTP/1.1 200 OK
Server: nginx/1.15.8
Date: Sun, 24 Feb 2019 04:38:20 GMT
Content-Type: application/octet-stream
Content-Length: 6950
Last-Modified: Sat, 23 Feb 2019 22:35:01 GMT
Connection: keep-alive
ETag: "5c71ca95-1b26"
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Cache-Control: max-age=315360000
Cache-Control: private
Accept-Ranges: bytes

asked 5 years ago584 views
1 Answer
0
Accepted Answer

S3 not send the 'Access-Control-Allow-Origin' header if the wildcard * like there:

<AllowedOrigin>*</AllowedOrigin>
Force s3 to send AllowedOrigin header and your content be loaded from any site, try this:

<AllowedOrigin>http://</AllowedOrigin>
<AllowedOrigin>https://
</AllowedOrigin>
i think one will work ..!

answered 5 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions