It is possible to list a part of the string using r2. in the case when I pass example/arquivo.jpg. W

It is possible to list a part of the string using r2. in the case when I pass example/arquivo.jpg. Where would I bring all the example files/

Original message was deleted

Manoj from ONEMCO•11/12/24, 12:49 PM

new credential works fine

Manoj from ONEMCO•11/12/24, 12:50 PM

So the issues is that if you create a storage bucket you need the new credentials.. which should not be the case

Manoj from ONEMCO•11/12/24, 1:03 PM

New key is working now everywhere... so all good I guess for now

MMateus Eduardo It is possible to list a part of the string using r2. in the case when I pass ex...

Mateus EduardoOP•11/12/24, 1:17 PM

I got it here

vytskalt•11/12/24, 4:20 PM

uhh so the r2 endpoint started giving me 403 errors out of nowhere saying

The request signature we calculated does not match the signature you provided. Check your secret access key and signing method.

The request signature we calculated does not match the signature you provided. Check your secret access key and signing method.

. I don't think I have changed anything in the environment that would cause this. I also tried changing the api key and it's still giving the same error. Am I the only one with this issue?

Deleted User•11/12/24, 4:31 PM

hey could anyone help me with r2 please

Deleted User•11/12/24, 4:31 PM

im getting cors because cloudflare is not adding 1 header

Deleted User•11/12/24, 4:31 PM

Access to audio at 'https://cdn.death.ovh/db40b78a-0b0c-4b38-afbd-20aff9cc098e.mp3' from origin 'https://death.ovh' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Deleted User•11/12/24, 4:32 PM

    "AllowedMethods": [
      "GET",
      "POST",
      "PUT",
      "DELETE",
      "HEAD"
    ],
    "AllowedHeaders": [
      "*"
    ],
    "ExposeHeaders": [
      "*"
    ],

    "AllowedMethods": [
      "GET",
      "POST",
      "PUT",
      "DELETE",
      "HEAD"
    ],
    "AllowedHeaders": [
      "*"
    ],
    "ExposeHeaders": [
      "*"
    ],

Deleted User•11/12/24, 4:32 PM

i got this in my config

Deleted User•11/12/24, 4:35 PM

aaaaaaaaaaaaaaa nvm

Deleted User•11/12/24, 4:35 PM

cache moment..

fry69•11/12/24, 4:36 PM

Otherwise ->

fry69•11/12/24, 4:36 PM

?r2-4xx-cors

Flare•11/12/24, 4:36 PM

Troubleshooting 403 / CORS issues with R2

So, your assets aren't loading because you are getting a CORS error despite having setup everything correctly?
Let's try troubleshooting.

In your browser console, do you see a 401/403 error right above the CORS error? If yes, then you aren't actually dealing with a CORS issue! If you do have a CORS issue, head to the last section.

If you are using a Custom domain

Go to the Network tab and find the failing request (you may need to reload the page, since only requests after opening the developer tools are logged).
You need to check the response headers for the following two headers:

cf-cache-statuscf-cache-status
cf-mitigatedcf-mitigated

### If you have a cf-mitigatedcf-mitigated header

Your request was blocked by one of your WAF rules. Go to Security Events and look for what service blocked your request.

If you don't have a `cf-cache-statuscf-cache-status` header

Your request was blocked by Hotlink Protection.
Go to your dashboard and disable it or write a configuration rule to only disable on your Custom domain

If you are using the S3 API

Your request is very likely incorrectly signed.
Try executing the request via curl to inspect the real response returned by the S3 api and then tackle that issue.
Once your request is correctly signed, you'll receive the proper CORS headers.

If it's actually CORS

Here are some common issues with CORS configurations:

ExposeHeadersExposeHeaders is missing headers like ETagETag
AllowedHeadersAllowedHeaders is missing headers like AuthorizationAuthorization or Content-TypeContent-Type
AllowedMethodsAllowedMethods is missing methods like
```
POST
```
```
POST
```
/PUTPUT (you do not need to include OPTIONSOPTIONS)

Ffry69 Otherwise ->

Deleted User•11/12/24, 4:40 PM

uh yeah

Deleted User•11/12/24, 4:40 PM

its not 403

Deleted User•11/12/24, 4:40 PM

its cors

Deleted User•11/12/24, 4:41 PM

and for the bttom section

Deleted User•11/12/24, 4:41 PM

i have that

Deleted User•11/12/24, 4:41 PM

its broken again

Deleted User•11/12/24, 4:41 PM

its weird as hell

Deleted User•11/12/24, 4:41 PM

ryz:1 Access to audio at 'https://cdn.death.ovh/568fd0a7-8b9b-4fca-8051-49024025290e.mp3' from origin 'https://death.ovh' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Deleted User•11/12/24, 4:41 PM

gettind ds again

Deleted User•11/12/24, 4:43 PM

DDeleted User ryz:1 Access to audio at 'https://cdn.death.ovh/568fd0a7-8b9b-4fca-8051-49024025...

YZ•11/12/24, 4:45 PM

I got the same error. When I followed the instruction to debug with curl, I found the returned pre-signed url worked on my server but not my local machine. I'm still getting @Space 's help to debug

YZ•11/12/24, 4:45 PM

In curl, I got 401 error

Deleted User•11/12/24, 4:45 PM

i think for me its the caching, it works on another browser

Deleted User•11/12/24, 4:45 PM

like no cors issue

Deleted User•11/12/24, 4:45 PM

but with my main browser it doers not work

Deleted User•11/12/24, 4:46 PM

its weird

YZ•11/12/24, 4:49 PM

@Mr. Catchii

You're in a better situation than me. Do you request the pre-signed url from the server or browser end? I requested the url from the server end, and it doesn't work on my broswer end.

YYZ @Mr. Catchii💯 You're in a better situation than me. Do you request the pre-sign...

Deleted User•11/12/24, 4:52 PM

uh browser end

Deleted User•11/12/24, 4:52 PM

i just put the cdn file

Deleted User•11/12/24, 4:52 PM

in frontend

Deleted User•11/12/24, 4:52 PM

and it works

Deleted User•11/12/24, 4:52 PM

idk

Noa•11/12/24, 5:03 PM

Hi! Can I use the S3 API to access a public bucket owned by someone else? The use case is that I want others to be able to get and list objects of my public bucket using the S3 API in python (boto3).

This answer suggests it's not possible but I wanted to check to be sure: https://community.cloudflare.com/t/get-public-bucket-url-using-boto3/470008

If this is the case, I can see two other options but they don't seem ideal to me:

I create an API key with read access that I distribute to everyone who will access the bucket
I use the
```
requests
```
```
requests
```
to download files from r2.dev url. But then I can only download files that I know the filename of, I can't list the files. And the documentation says that rate limits apply.

Noa•11/12/24, 5:05 PM

That's great, but it adds complexity to distribute the api key so I'd prefer if there's another way

Noa•11/12/24, 5:19 PM

Thanks for the info, but I'm afraid custom domain is infeasible for my use case as well

kubectl•11/12/24, 7:47 PM

Heyyyo! Whats the general recommended way to protect against hotlinking? I.e. prevent another site loading the content from my r2 bucket? Lets assume they do not send a Referer Header.

Original message was deleted

kubectl•11/12/24, 7:59 PM

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy#integration_with_html
its very much possible sadly

MDN Web Docs

Referrer-Policy - HTTP | MDN

The HTTP Referrer-Policy response header controls how much referrer information (sent with the Referer header) should be included with requests.
Aside from the HTTP header, you can set this policy in HTML.

kubectl•11/12/24, 8:01 PM

and then what? Its like you said, ppl can spoof whatever i put in there

Deleted User•11/12/24, 9:03 PM

yeah i going crazy with this r2 stuff

Deleted User•11/12/24, 9:03 PM

the cors is killing me

Deleted User•11/12/24, 9:04 PM

nothing works

It is possible to list a part of the string using r2. in the case when I pass example/arquivo.jpg. W

Troubleshooting 403 / CORS issues with R2

If you are using a Custom domain

If you don't have a `cf-cache-statuscf-cache-status` header

If you are using the S3 API

If it's actually CORS

Similar Threads

Similar Threads

Troubleshooting 403 / CORS issues with R2

If you are using a Custom domain

If you don't have a
`cf-cache-status`
`cf-cache-status`
`cf-cache-status`
`cf-cache-status` header

If you are using the S3 API

If it's actually CORS

Similar Threads

It is possible to list a part of the string using r2. in the case when I pass example/arquivo.jpg. W

Troubleshooting 403 / CORS issues with R2

If you are using a Custom domain

If you don't have a cf-cache-statuscf-cache-status header

If you are using the S3 API

If it's actually CORS

Similar Threads

Similar Threads

Troubleshooting 403 / CORS issues with R2

If you are using a Custom domain

If you don't have a cf-cache-statuscf-cache-statuscf-cache-statuscf-cache-status header

If you are using the S3 API

If it's actually CORS

Similar Threads

If you don't have a `cf-cache-statuscf-cache-status` header

If you don't have a
`cf-cache-status`
`cf-cache-status`
`cf-cache-status`
`cf-cache-status` header