---
title: "Bucket CORS Support With the Wasabi S3 API"
slug: "bucket-cors-support-with-the-wasabi-s3-api"
updated: 2026-10-26T13:37:51Z
published: 2026-10-26T13:37:51Z
canonical: "docs.wasabi.com/bucket-cors-support-with-the-wasabi-s3-api"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wasabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Bucket CORS Support With the Wasabi S3 API

To ensure compatibility with browser access to Wasabi as a web server, the Wasabi server will return the Cross-Origin Resource Sharing (CORS) headers when the “Origin” header is present in an HTTP request. Additionally, the server supports the HTTP method OPTIONS on either buckets or objects to CORS headers needed for a browser pre-flight test before accessing Wasabi.

Bucket-level CORS via the S3 API is fully supported. Unlike AWS, Wasabi returns settings that allow the browser full access to Wasabi. However, note that allowing the browser full access to data does not affect the security of access to any objects; all access policies will still be enforced.

The following are the HTTP headers returned by default when the header “Origin” is given in an HTTP request:

```plaintext
Access-Control-Allow-Headers: *
Access-Control-Allow-Methods: GET, HEAD, POST, PUT, DELETE, MOVE, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Access-Control-Max-Age: 86400
```