From d4bdeb2ed45ba883792c904b02ad3ddda55cdccd Mon Sep 17 00:00:00 2001 From: chrislusf Date: Fri, 31 Oct 2025 17:13:46 -0700 Subject: [PATCH] Update S3-CORS.md --- S3-CORS.md | 38 +++++++++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/S3-CORS.md b/S3-CORS.md index 98de3f6..f2b1ee2 100644 --- a/S3-CORS.md +++ b/S3-CORS.md @@ -7,12 +7,48 @@ SeaweedFS supports S3-compatible Cross-Origin Resource Sharing (CORS) configurat CORS defines a way for web applications running at one domain to access resources at another domain. When a web application tries to access your S3 bucket from a different domain, the browser will first send a preflight OPTIONS request to check if the cross-origin request is allowed. SeaweedFS handles CORS through: +- **Global CORS configuration**: Server-wide default CORS settings - **Bucket-level CORS configuration**: Each bucket can have its own CORS rules - **Persistent storage**: CORS configurations are stored in bucket metadata - **Automatic header handling**: CORS middleware automatically applies appropriate headers - **Preflight request support**: Proper handling of OPTIONS requests -## CORS Configuration +## Quick Start: Global CORS Configuration + +The simplest way to enable CORS for all buckets is using the `-s3.allowedOrigins` parameter: + +```bash +# Allow all origins (useful for development) +weed server -s3 -s3.allowedOrigins=* + +# Allow specific origins +weed server -s3 -s3.allowedOrigins=https://app.example.com,https://admin.example.com + +# Docker Compose example +services: + seaweedfs: + image: chrislusf/seaweedfs:latest + command: "server -s3 -s3.allowedOrigins=*" +``` + +This global configuration: +- Works immediately without additional setup +- Applies to all buckets by default +- Can be overridden by bucket-level CORS configuration +- Supports GET, PUT, POST, DELETE, and HEAD methods +- Allows all headers (*) + +### CORS Configuration Priority + +SeaweedFS uses the following priority order: + +1. **Bucket-level CORS** (if configured via `aws s3api put-bucket-cors`) - highest priority +2. **Global CORS** (from `-s3.allowedOrigins` parameter) - fallback if no bucket config +3. **No CORS** (if neither is configured) - no CORS headers applied + +This means you can set a permissive global default and override it with stricter rules for specific buckets. + +## Advanced: Bucket-Level CORS Configuration ### Basic CORS Rule Structure