Introduction to Cross-origin Access

Cross-origin resource sharing is a normative mechanism of Web browser proposed by W3C standardization organization. It defines the way a web application loaded in one origin interacts with resources in another origin. For normal Web-page requests, however, due to the existence of the same origin policy (SOP), website scripts and content among origins are non-interactive.

Typical applications:

Through cross-origin access settings, users can use JavaScript and HTML5 to build Web applications and directly access the resources in ZOS, without the need of proxy servers.

The drag-and-drop function in HTML5 can be used to upload files directly to ZOS, or update the content directly from Web applications.

External Web pages, style sheets and HTML5 applications hosted in different domains can now use Web fonts or images stored in ZOS, so that these resources can be shared across websites.

Cross-origin Access Configuration

ZOS provides cross-origin resource sharing settings in the HTML5 protocol to help you achieve cross-origin access.

①　On the ZOS Console, click the bucket to go to the Overview page.

②　Select the Permission Management page, and then Cross-origin Settings , and click Settings .

③　Click Create Rule and configure the following cross-origin access parameters in the pop-up **Create Cross-origin Rule **dialog box.

Parameters	Description
Source	Specify the source of allowed cross-origin requests. The configuration rules are as follows:Multiple matching rules are allowed. Rules are separated by line breaks.A domain name should include the protocol name, such as HTTP and HTTPS.The wildcard () is supported. At most one wildcard ( ) is allowed for each matching rule.If the default port is not used for a domain name, the port number shall also be appended. For example, https://www.example.com:8080.A domain name is configured as follows:Fill in the complete form of a domain name when matching the specified domain name, for example, https://www.example.com.The wildcard ( ) can be used to match a second-level domain name. For example, https:// .example.com.You can directly fill in the wildcard (*) to match all domain names.
Allowed Methods	Specify the allowed cross-origin request method.
Allowed Headers	Specify the response header that allows cross-origin requests. The configuration rules are as follows:The format is key:value, for example, content-type:text/plain, which is case-insensitive.Multiple matching rules are allowed. Rules are separated by line breaks.At most one wildcard () can be used for each matching rule. It is recommended to set the wildcard to an asterisk ( ) unless otherwise specified.
Exposed Headers	Specify the response header that is accessible to users from an application. For example, an XMLHttpRequest object in Javascript. The wildcard (*) is not allowed.
Cache Time	Specify how long a browser should cache the return result of a prefetch (OPTIONS) request for a particular resource.
Return Vary:Origin	Configure whether to return Vary:OriginHeader.If both CORS and non-CORS requests exist in practical applications, or there are many possible values in the Origin header, it is recommended to selectReturn Vary:Originto avoid local cache error.

Click OK to finish creating.

Zettabyte Object Storage

Cross-origin Access Settings