Otherwise ->

fry69OP•11/12/24, 4:36 PM

?r2-4xx-cors

Flare•11/12/24, 4:36 PM

Troubleshooting 403 / CORS issues with R2

So, your assets aren't loading because you are getting a CORS error despite having setup everything correctly?
Let's try troubleshooting.

In your browser console, do you see a 401/403 error right above the CORS error? If yes, then you aren't actually dealing with a CORS issue! If you do have a CORS issue, head to the last section.

If you are using a Custom domain

Go to the Network tab and find the failing request (you may need to reload the page, since only requests after opening the developer tools are logged).
You need to check the response headers for the following two headers:

cf-cache-statuscf-cache-status
cf-mitigatedcf-mitigated

### If you have a cf-mitigatedcf-mitigated header

Your request was blocked by one of your WAF rules. Go to Security Events and look for what service blocked your request.

If you don't have a `cf-cache-statuscf-cache-status` header

Your request was blocked by Hotlink Protection.
Go to your dashboard and disable it or write a configuration rule to only disable on your Custom domain

If you are using the S3 API

Your request is very likely incorrectly signed.
Try executing the request via curl to inspect the real response returned by the S3 api and then tackle that issue.
Once your request is correctly signed, you'll receive the proper CORS headers.

If it's actually CORS

Here are some common issues with CORS configurations:

ExposeHeadersExposeHeaders is missing headers like ETagETag
AllowedHeadersAllowedHeaders is missing headers like AuthorizationAuthorization or
```
Content-Type
```
```
Content-Type
```
AllowedMethodsAllowedMethods is missing methods like
```
POST
```
```
POST
```
/PUTPUT (you do not need to include OPTIONSOPTIONS)

Ffry69 Otherwise ->

Deleted User•11/12/24, 4:40 PM

uh yeah

Deleted User•11/12/24, 4:40 PM

its not 403

Deleted User•11/12/24, 4:40 PM

its cors

Deleted User•11/12/24, 4:41 PM

and for the bttom section

Deleted User•11/12/24, 4:41 PM

i have that

Deleted User•11/12/24, 4:41 PM

its broken again

Deleted User•11/12/24, 4:41 PM

its weird as hell

Deleted User•11/12/24, 4:41 PM

ryz:1 Access to audio at 'https://cdn.death.ovh/568fd0a7-8b9b-4fca-8051-49024025290e.mp3' from origin 'https://death.ovh' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Deleted User•11/12/24, 4:41 PM

gettind ds again

Deleted User•11/12/24, 4:43 PM

DDeleted User ryz:1 Access to audio at 'https://cdn.death.ovh/568fd0a7-8b9b-4fca-8051-49024025...

YZ•11/12/24, 4:45 PM

I got the same error. When I followed the instruction to debug with curl, I found the returned pre-signed url worked on my server but not my local machine. I'm still getting @Space 's help to debug

YZ•11/12/24, 4:45 PM

In curl, I got 401 error

Deleted User•11/12/24, 4:45 PM

i think for me its the caching, it works on another browser

Deleted User•11/12/24, 4:45 PM

like no cors issue

Deleted User•11/12/24, 4:45 PM

but with my main browser it doers not work

Deleted User•11/12/24, 4:46 PM

its weird

YZ•11/12/24, 4:49 PM

@Mr. Catchii

You're in a better situation than me. Do you request the pre-signed url from the server or browser end? I requested the url from the server end, and it doesn't work on my broswer end.

YYZ @Mr. Catchii💯 You're in a better situation than me. Do you request the pre-sign...

Deleted User•11/12/24, 4:52 PM

uh browser end

Deleted User•11/12/24, 4:52 PM

i just put the cdn file

Deleted User•11/12/24, 4:52 PM

in frontend

Deleted User•11/12/24, 4:52 PM

and it works

Deleted User•11/12/24, 4:52 PM

idk

Noa•11/12/24, 5:03 PM

Hi! Can I use the S3 API to access a public bucket owned by someone else? The use case is that I want others to be able to get and list objects of my public bucket using the S3 API in python (boto3).

This answer suggests it's not possible but I wanted to check to be sure: https://community.cloudflare.com/t/get-public-bucket-url-using-boto3/470008

If this is the case, I can see two other options but they don't seem ideal to me:

I create an API key with read access that I distribute to everyone who will access the bucket
I use the requestsrequests to download files from r2.dev url. But then I can only download files that I know the filename of, I can't list the files. And the documentation says that rate limits apply.

Noa•11/12/24, 5:05 PM

That's great, but it adds complexity to distribute the api key so I'd prefer if there's another way

Noa•11/12/24, 5:19 PM

Thanks for the info, but I'm afraid custom domain is infeasible for my use case as well

kubectl•11/12/24, 7:47 PM

Heyyyo! Whats the general recommended way to protect against hotlinking? I.e. prevent another site loading the content from my r2 bucket? Lets assume they do not send a Referer Header.

Original message was deleted

kubectl•11/12/24, 7:59 PM

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy#integration_with_html
its very much possible sadly

MDN Web Docs

Referrer-Policy - HTTP | MDN

The HTTP Referrer-Policy response header controls how much referrer information (sent with the Referer header) should be included with requests.
Aside from the HTTP header, you can set this policy in HTML.

kubectl•11/12/24, 8:01 PM

and then what? Its like you said, ppl can spoof whatever i put in there

Deleted User•11/12/24, 9:03 PM

yeah i going crazy with this r2 stuff

Deleted User•11/12/24, 9:03 PM

the cors is killing me

Deleted User•11/12/24, 9:04 PM

nothing works

Advany•11/13/24, 9:45 AM

I keep getting get: Unspecified error (0) when using r2 with workers. It happens randomly. Most of the times it works but fails a couple of times a day. I also created a ticket on 15 oct (month ago) with case id 01231975 but no response after the initial.

Original message was deleted

Advany•11/13/24, 9:49 AM

couple 10k a day orso

AAdvany couple 10k a day orso

Advany•11/13/24, 9:49 AM

worker itself is doing more, but the r2 binding using get is called like 10k times a day

Otherwise ->

Troubleshooting 403 / CORS issues with R2

If you are using a Custom domain

If you don't have a `cf-cache-statuscf-cache-status` header

If you are using the S3 API

If it's actually CORS

Similar Threads

Similar Threads

Similar Threads

Troubleshooting 403 / CORS issues with R2

If you are using a Custom domain

If you don't have a
`cf-cache-status`
`cf-cache-status`
`cf-cache-status`
`cf-cache-status` header

If you are using the S3 API

If it's actually CORS

Otherwise ->

Troubleshooting 403 / CORS issues with R2

If you are using a Custom domain

If you don't have a cf-cache-statuscf-cache-status header

If you are using the S3 API

If it's actually CORS

Similar Threads

Similar Threads

Similar Threads

Troubleshooting 403 / CORS issues with R2

If you are using a Custom domain

If you don't have a cf-cache-statuscf-cache-statuscf-cache-statuscf-cache-status header

If you are using the S3 API

If it's actually CORS

If you don't have a `cf-cache-statuscf-cache-status` header

If you don't have a
`cf-cache-status`
`cf-cache-status`
`cf-cache-status`
`cf-cache-status` header