To ensure compatibility with browser access to Wasabi as a web server, the Wasabi server will return the Cross-Origin Resource Sharing (CORS) headers when the “Origin” header is present in an HTTP request. Additionally, the server supports the HTTP method OPTIONS on either buckets or objects to CORS headers needed for a browser pre-flight test before accessing Wasabi.
Bucket-level CORS via the S3 API is fully supported. Unlike AWS, Wasabi returns settings that allow the browser full access to Wasabi. However, note that allowing the browser full access to data does not affect the security of access to any objects; all access policies will still be enforced.
The following are the HTTP headers returned by default when the header “Origin” is given in an HTTP request:
Access-Control-Allow-Headers: *
Access-Control-Allow-Methods: GET, HEAD, POST, PUT, DELETE, MOVE, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Access-Control-Max-Age: 86400