Update S3-CORS.md

chrislusf
2025-10-31 17:13:46 -07:00
parent 98dd767205
commit d4bdeb2ed4
+37 -1
@@ -7,12 +7,48 @@ SeaweedFS supports S3-compatible Cross-Origin Resource Sharing (CORS) configurat
CORS defines a way for web applications running at one domain to access resources at another domain. When a web application tries to access your S3 bucket from a different domain, the browser will first send a preflight OPTIONS request to check if the cross-origin request is allowed.
SeaweedFS handles CORS through:
- **Global CORS configuration**: Server-wide default CORS settings
- **Bucket-level CORS configuration**: Each bucket can have its own CORS rules
- **Persistent storage**: CORS configurations are stored in bucket metadata
- **Automatic header handling**: CORS middleware automatically applies appropriate headers
- **Preflight request support**: Proper handling of OPTIONS requests
## CORS Configuration
## Quick Start: Global CORS Configuration
The simplest way to enable CORS for all buckets is using the `-s3.allowedOrigins` parameter:
```bash
# Allow all origins (useful for development)
weed server -s3 -s3.allowedOrigins=*
# Allow specific origins
weed server -s3 -s3.allowedOrigins=https://app.example.com,https://admin.example.com
# Docker Compose example
services:
seaweedfs:
image: chrislusf/seaweedfs:latest
command: "server -s3 -s3.allowedOrigins=*"
```
This global configuration:
- Works immediately without additional setup
- Applies to all buckets by default
- Can be overridden by bucket-level CORS configuration
- Supports GET, PUT, POST, DELETE, and HEAD methods
- Allows all headers (*)
### CORS Configuration Priority
SeaweedFS uses the following priority order:
1. **Bucket-level CORS** (if configured via `aws s3api put-bucket-cors`) - highest priority
2. **Global CORS** (from `-s3.allowedOrigins` parameter) - fallback if no bucket config
3. **No CORS** (if neither is configured) - no CORS headers applied
This means you can set a permissive global default and override it with stricter rules for specific buckets.
## Advanced: Bucket-Level CORS Configuration
### Basic CORS Rule Structure