GetBucketCors
Updated at：2025-11-03
API description
This API fetches the current CORS rules of a specified bucket.
Permission
Only bucket owners or users with FULL_CONTROL permission can set bucket CORS rules. If this permission is not granted, the system returns a 403 Forbidden error with the AccessDenied error code.
Request
-
Request syntax
Plain Text1GET /?cors HTTP/1.1 2Host: <BucketName>.bj.bcebos.com 3Date: date 4Authorization: <AuthorizationString> -
Request parameters
None
-
Request headers
No special header parameters
-
Request elements
None
Response
| Name | Description | Whether required | Parent node |
|---|---|---|---|
| corsConfiguration | A container for bucket CORS rules, with each bucket supporting up to 100 rules. If multiple configurations exist, they are processed in top-to-bottom order. | Yes | None |
| allowedOrigins | A container that stores the allowed origins for cross-origin requests. | Yes | corsConfiguration |
| allowedOrigin | Specified allowed origin for cross-origin requests, allowing up to one * wildcard. If it is specified as *, cross-origin requests from all sources are allowed. Specifically, * can be used as a suffix to indicate a category of websites. For example, abc* indicates that websites starting with "abc" is allowed. Note: allowedOrigin matching is case-sensitive. Type: string |
Yes | allowedOrigins |
| allowedMethods | A container that stores the allowed methods for cross-origin requests. | Yes | corsConfiguration |
| allowedMethod | Specified allowed cross-origin request methods. It does not support the wildcard *, and is case-sensitive. Type: Enumeration, with values "GET, PUT, DELETE, POST, HEAD". |
Yes | allowedMethods |
| allowedHeaders | A container that stores the allowed headers, controlling whether the headers specified in the Access-Control-Request-Headers of the OPTIONS prefetch request are permitted. | No | corsConfiguration |
| allowedHeader | It controls whether the headers specified in the Access-Control-Request-Headers of the OPTIONS prefetch command are allowed. Each header specified in Access-Control-Request-Headers must have a corresponding entry in allowedHeader. Each header allows up to one * wildcard, and is case-insensitive. Type: string. |
No | allowedHeaders |
| allowedExposeHeaders | A container that stores the response headers accessible to users from applications. | No | corsConfiguration |
| allowedExposeHeader | Specified response headers accessible to users from applications (e.g., the XMLHttpRequest object of one Javascript). The use of wildcard * is not allowed. Access-Control-Expose-Headers will be set in OPTIONS requests based on this definition. Type: string. |
No | allowedExposeHeaders |
| maxAgeSeconds | Specifies the cache duration (in seconds) in the browser for the OPTIONS prefetch response results, during which repeated prefetch requests are not required. Type: Int64. | No | corsConfiguration |
Notes
- If the bucket does not exist, a 404 Not Found error will be returned with the error code NoSuchBucket.
- If the CORS rule is absent, the server will respond with a 404 Not Found error and the error code NoSuchCORSConfiguration.
Example
-
Request example
Plain Text1 GET /?cors HTTP/1.1 2 Host: <BucketName>.bj.bcebos.com 3 Date: Wed, 06 Apr 2016 06:34:40 GMT 4 Authorization: AuthorizationString -
Response example
Plain Text1HTTP/1.1 200 OK 2x-bce-request-id: 4db2b34d-654d-4d8a-b49b-3049ca786409 3Date: Wed, 06 Apr 2016 06:34:40 GMT 4Content-Length: 1324 5Content-Type: application/json; charset=utf-8 6Server: BceBos 7{ 8 "corsConfiguration": [ 9 { 10 "allowedOrigins": [ 11 "http://www.example.com", 12 "www.example2.com" 13 ], 14 "allowedMethods": [ 15 "GET", 16 "HEAD", 17 "DELETE" 18 ], 19 "allowedHeaders": [ 20 "Authorization", 21 "x-bce-test", 22 "x-bce-test2" 23 ], 24 "allowedExposeHeaders": [ 25 "user-custom-expose-header" 26 ], 27 "maxAgeSeconds": 3600 28 }， 29 { 30 "allowedOrigins": [ 31 "http://www.baidu.com" 32 ], 33 "allowedMethods": [ 34 "GET", 35 "HEAD", 36 "DELETE" 37 ], 38 "allowedHeaders": [ 39 "*" 40 ], 41 "allowedExposeHeaders": [ 42 "user-custom-expose-header" 43 ], 44 "maxAgeSeconds": 1800 45 } 46 ] 47}