Set up and view CORS configurations

Overview Configuration samples

Cross-origin resource sharing (CORS) allows interactions between resources from different origins, something that is normally prohibited in order to prevent malicious behavior. Use this page to learn how to set a CORS configuration on a Cloud Storage bucket and how to view the CORS configuration set on a bucket. See Configuration examples for CORS for example CORS configurations.

Required roles

To get the permissions that you need to set and view the CORS configuration on a bucket, ask your administrator to grant you the Storage Admin (roles/storage.admin) role on the bucket.

This predefined role contains the permissions required to set and view CORS configurations. To see the exact permissions that are required, expand the Required permissions section:

Required permissions

storage.buckets.get
storage.buckets.update

You can also get these permissions with other predefined roles or custom roles.

For information about granting roles on buckets, see Set and manage IAM policies on buckets.

Set the CORS configuration on a bucket

You set a CORS configuration on a bucket by specifying information, such as HTTP methods and originating domains, that identifies the types of requests the bucket can accept.

Use the following steps to set a CORS configuration on your bucket:

Console

In the Google Cloud console, go to the Cloud Storage Buckets page.

Go to Buckets
Click the name of the bucket.
Click the Configuration tab.
In the Cross-origin resource sharing section, click Edit CORS configuration.
Select the Allow cross-origin resource sharing checkbox.
Click Add a configuration, and then do the following:
1. Provide values for the fields in the configuration:
  - List of allowed origins: the origins that you want to allow for cross-origin resource sharing with this bucket.
  - Specify methods: the HTTP methods that you want to allow for cross-origin resource sharing with this bucket.
  - List of allowed response headers: the response headers that you want to allow for cross-origin resource sharing with this bucket.
  - Cache expiry time: the number of seconds the browser is allowed to make requests before it must repeat the preflight request.
  For more information about each field, see Components of a CORS configuration.
2. Click Done.
Optional: To add additional configurations, repeat the previous step.
Click Save.

Command line

Create a JSON file with the CORS configuration you would like to apply. See configuration examples for sample JSON files.
Use the gcloud storage buckets update command with the --cors-file flag:
```
gcloud storage buckets update gs://BUCKET_NAME --cors-file=CORS_CONFIG_FILE
```
Where:
- BUCKET_NAME is the name of the relevant bucket. For example, my-bucket.
- CORS_CONFIG_FILE is the path to the JSON file you created in Step 1.

Client libraries

C++

For more information, see the Cloud Storage C++ API reference documentation.

To authenticate to Cloud Storage, set up Application Default Credentials. For more information, see Set up authentication for client libraries.

The following sample sets a CORS configuration on a bucket:

namespace gcs = ::google::cloud::storage;
using ::google::cloud::StatusOr;
[](gcs::Client client, std::string const& bucket_name,
   std::string const& origin) {
  StatusOr<gcs::BucketMetadata> original =
      client.GetBucketMetadata(bucket_name);

  if (!original) throw std::move(original).status();
  std::vector<gcs::CorsEntry> cors_configuration;
  cors_configuration.emplace_back(
      gcs::CorsEntry{3600, {"GET"}, {origin}, {"Content-Type"}});

  StatusOr<gcs::BucketMetadata> patched = client.PatchBucket(
      bucket_name,
      gcs::BucketMetadataPatchBuilder().SetCors(cors_configuration),
      gcs::IfMetagenerationMatch(original->metageneration()));
  if (!patched) throw std::move(patched).status();

  if (patched->cors().empty()) {
    std::cout << "Cors configuration is not set for bucket "
              << patched->name() << "\n";
    return;
  }

  std::cout << "Cors configuration successfully set for bucket "
            << patched->name() << "\nNew cors configuration: ";
  for (auto const& cors_entry : patched->cors()) {
    std::cout << "\n  " << cors_entry << "\n";
  }
}

C#

For more information, see the Cloud Storage C# API reference documentation.