cloudscaleKnowledge Base

You can make objects publicly accessible, e.g. by means of:

s3cmd --acl-public setacl s3://my-bucket/my-font.woff2

The object is then directly available (without access key and secret key authentication) at https://my-bucket.objects.lpg.cloudscale.ch/my-font.woff2.

However, when integrating it into a website – e.g. https://www.example.com – the browser may not load the file due to the same-origin policy. In this case, help is available in the form of CORS (cross-origin resource sharing) headers that you configure on your bucket. To do this, create a file as follows and save it locally, e.g. under cors.xml:

<CORSConfiguration>
  <CORSRule>
    <AllowedOrigin>https://www.example.com</AllowedOrigin>
    <AllowedMethod>GET</AllowedMethod>
  </CORSRule>
</CORSConfiguration>

Then transfer this configuration to your bucket by means of e.g. s3cmd:

s3cmd setcors cors.xml s3://my-bucket

When visiting https://www.example.com the browser will access https://my-bucket.objects.lpg.cloudscale.ch/my-font.woff2 in a "preflight" request and send the HTTP header

Origin: https://www.example.com

in the request. If the sent URL matches the one configured on the bucket, the object storage adds the headers

access-control-allow-origin: https://www.example.com
access-control-allow-methods: GET

to its response, thus signalling to the browser that the file may be loaded in the context of this website.