OPTIONSObject
Updated at：2025-11-03
API description
Before making a cross-domain request, the browser sends a preflight request (OPTIONS) containing specific origin domains, HTTP methods, and header details to BOS to determine whether the actual request should be sent. This API handles such preflight requests.
Permission
Authentication is not needed for running the OPTIONS Object operation.
Request
-
Request syntax
Plain Text1 OPTIONS /<ObjectKey> HTTP/1.1 2 Host: <BucketName>.bj.bcebos.com 3 Origin: Origin 4 Access-Control-Request-Method: HTTPMethod 5 Access-Control-Request-Headers: RequestHeader -
Request parameters
None
-
Request headers
| Name | Description | Whether required |
|---|---|---|
| Origin | Origin domain of the request, used to identify cross-domain requests. Type: string. Default value: None. | Yes |
| Access-Control-Request-Method | The HTTP method to be employed in the actual request. Only one method is allowed. Type: string. Options include "PUT/GET/DELETE/POST/HEAD," with no default value. | Yes |
| Access-Control-Request-Headers | Headers beyond simple headers to be used in the actual request should be listed and separated by commas. Type: string. Default value: None. | No |
Response
| Name | Description |
|---|---|
| Access-Control-Allow-Credentials | Whether the BOS Server allows Client to include cookie in request. It takes effect if there is simultaneous allowance from both the Client and Server. BOS returns allowance when the request is approved, namely true, case sensitive. |
| Access-Control-Allow-Headers | A list of headers permitted in the request. If the request includes any disallowed headers, the CORS rule validation will fail, and headers without Access-Control prefixes will be returned. Multiple headers are separated by commas. Note: Only the list of headers in this request is returned, regardless of any additional allowed headers specified in the configuration file. |
| Access-Control-Allow-Methods | Permitted HTTP methods for the request. If the request method is not allowed, the header and all other Access-Control-related headers are omitted. Type: string. Note: The entire list of allowed methods is returned, not just the one used in this request. |
| Access-Control-Allow-Origin | The origin specified in the request. If not allowed, the header and all other Access-Control-related headers are omitted. Type: string. |
| Access-Control-Expose-Headers | A list of headers that can be accessed by the JavaScript program on the requester side. These correspond to exposeHeaders in the configuration file. Type: string. |
| Access-Control-Max-Age | The duration in seconds for which the browser is permitted to cache preflight request results. Type: Integer. |
Notes
- Upon receiving an OPTIONS request, CORS checks the corresponding rules configured for the bucket and evaluates the appropriate permissions. Rules are assessed one by one in sequence. The first matching rule is applied to allow the request and return the appropriate header. If no rules match, no CORS-related headers will be included.
The successful match of CORS Rule must satisfy three conditions:
- The request origin must match one of the allowed origins.
- The method specified in the Access-Control-Request-Method of the OPTIONS request must match one of the allowed methods.
- Every header listed in the Access-Control-Request-Headers of the OPTIONS request must correspond to an allowed header item. A mismatch of even one will result in failure.
Example
-
Request example
Plain Text1 OPTIONS /object HTTP/1.1 2 Host: BucketName.bj.bcebos.com 3 Origin: http://www.example.com 4 Access-Control-Request-Method: GET 5 Access-Control-Request-Headers: x-bce-test -
Response example
Plain Text1 HTTP/1.1 200 OK 2 x-bce-request-id: 4db2b34d-654d-4d8a-b49b-3049ca786409 3 Date: Wed, 06 Apr 2016 06:34:40 GMT 4 Access-Control-Allow-Origin: http://www.example.com 5 Access-Control-Allow-Methods: GET, HEAD, DELETE 6 Access-Control-Allow-Headers: x-bce-test 7 Access-Control-Expose-Headers: user-custom-expose-header 8 Access-Control-Max-Age: 3600 9 Access-Control-Allow-Credentials: true 10 Content-Length: 0 11 Server: BceBos