Overview of Cross-Origin Access

Cross-Origin Resource Sharing (CORS) is a standard cross-origin solution provided by HTML5. Also called JavaScript CORS, it serves as a security measure known as the Same Origin Policy (SOP) for browsers. When JavaScript code from website A attempts to access website B, the browser denies the access because websites A and B belong to different origins. This is due to the restriction that website scripts and content from different origins cannot interact.

Typical Scenario

CORS only comes into play when accessing ZOS using browsers. It is not a concern when using clients for access. ZOS facilitates HTML5 CORS settings to enable CORS.

Operation Steps

On the homepage of the official eSurfing Cloud website, click Console , and enter your username and password to log in to the console.
In the upper part of the console, click and select a region. In this example, Asia Pacific-China (Hong Kong 2) is selected.
Choose Storage > Zettabyte Object Storage .
In the ZOS console, click the bucket name to open the overview page.
Click the Permission Management tab, and click Setting in the Cross-domain Settings section.
In the Cross-domain Settings section, click Create Policy .
According to the cross-origin rule parameter configuration description to configure parameters, and click OK to complete the creation.

Cross-Origin Rule Creation Parameter Description

Parameter	Description
Allowed Origins	Specify the source of allowed cross-domain requests. Configuration rules: Multiple matching rules are allowed. Separate the rules with line breaks. The domain name or IP of each line must start with http:// or https:// and cannot end with /. The wildcard asterisk () is supported. Maximum one asterisk ( ) per line. Spaces and Chinese characters are not supported. If the domain name is not the default port, the port number should be specified, e.g., https://www.example.com:8080. Example of domain name configuration: To match a specified domain name, fill in its full name, e.g., https://www.example.com. To match a wildcard second-level domain name, use the wildcard asterisk ( )e.g., https://.example.com. To match all domain names, simply fill in the wildcard asterisk ( ).
Allowed Methods	Specify the allowed methods for CORS.
Allowed Headers	Specify the response header that allows cross-domain requests. Configuration rules: Multiple matching rules are allowed. Separate the rules with line breaks. Maximum one wildcard asterisk () for one matching rule, and spaces are not supported. It is recommended to set it as asterisk ( ) in case of no special requirements.
Exposed Headers	Specify the response header that allows user to access from the application. e.g., Javascript XMLHttpRequest object. Multiple matching rules are allowed. Separate the rules with line breaks. Wildcard asterisks (*) and spaces are not supported.
Cache Time	Specify the cache duration for the returned results of OPTIONS requests to specific resources in browsers.

Description

You can navigate to the Permission Management page through the Overview page > Basic Setting > Cross-domain Access .

Zettabyte Object Storage

Cross Domain Access Settings