Use a bucket CORS rule when an intended web application needs to make cross-origin S3 requests from a browser. CORS controls browser behaviour; it does not make private objects public or replace AWS authorisation.

Prepare the browser request

Identify the exact application origin, required methods and response headers the application must read. Keep authenticated operations on the intended service credential or suitably scoped presigned request. Do not put the host’s AWS key into browser code.

Save the intended rules

1. Open the service’s Storage settings → CORS controls and select the exact bucket.
2. Enter the intended Allowed origins.
3. Select only the required Allowed methods.
4. Review optional Expose headers and preflight Cache time.
5. Review the complete rule set, save and read it back.

Saving replaces the represented CORS configuration; an empty set removes it. Preserve other required application origins deliberately.

Test the actual browser operation

Test from the intended origin, using the same method and requested headers as the application. Compare the browser’s preflight response and the authenticated S3 operation separately. AWS’s CORS troubleshooting guide distinguishes origin, method and header mismatches.

A successful desktop storage-client upload does not prove browser CORS is configured. Conversely, a matching CORS rule cannot repair an expired link, disabled key or hard-quota upload pause.

For a refused save, have the host check its bucket CORS-management permission. Retain the origin, method, original time and redacted error while your hosting team checks the failing stage; exclude secrets and full signed URLs.

Check the saved CORS rules

Your hosting team should compare the exact bucket, prior complete CORS set, intended browser origin/method and reopened saved rules with the actual preflight and authenticated S3 result. Check response-header exposure separately from request authentication, expiry, key status and quota. Your AWS administrator should review a bucket-setting permission refusal; do not use a host key in browser code or open every origin to hide a different problem. Do not include a signed URL or customer upload.

See the PD AWS S3 WHMCS guide for related tasks, or explore the module.