Problem with Storage

Ise · 2025-07-02T09:39:17.054Z

This is my function to get the Signed Url of a file in the storage: const signedUrl = useCallback( async (download = false) => { if (!file.storage_key) throw new Error('storage_key mancante'); const { data, error } = await supabase.storage .from(BUCKET_NAME) .createSignedUrl(file.storage_key, 60, { download }); if (error || !data?.signedUrl) throw error ?? new Error('URL non trovato'); return data.signedUrl; }, [file.storage_key, supabase] ); When this function is executed i get this error: materiali:1 Access to fetch at 'https://supabase.justware.it/storage/v1/object/sign/public-files/Corso%20SCRATCH.pdf' from origin 'https://justware.it' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. What is the problem?

I

inder•7/2/25, 9:53 AM

If I recall correctly, you're using coolify right?

I

IseOP•7/2/25, 10:10 AM

Yes

I

inder•7/2/25, 10:39 AM

will have to add cors headers to storage service. Earlier kong was handling cors headers. I'm testing it. Will send you config in a bit

I

IseOP•7/2/25, 10:57 AM

Ok thanks!

IIse Ok thanks!

I

inder•7/2/25, 11:35 AM

Add these additional labels to storage service labels. In the previous thread, there was a item in the labels

traefik.http.routers.supabase-storage.middlewares=strip-storage-prefix

traefik.http.routers.supabase-storage.middlewares=strip-storage-prefix

traefik.http.routers.supabase-storage.middlewares=strip-storage-prefix

traefik.http.routers.supabase-storage.middlewares=strip-storage-prefix, only remove that line.

      # https://stackoverflow.com/a/74982013
      # if you only want to allow requests from only one origin, you can update alloworiginlist. This will only affect storage endpoint
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolalloworiginlist=*
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolallowmethods=*
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolallowheaders=*
      # adjust maxage acc. to your needs
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolmaxage=86400 
      - traefik.http.middlewares.supabase-storage-cors.headers.addvaryheader=true
    
      - traefik.http.routers.supabase-storage.middlewares=supabase-storage-cors,strip-storage-prefix

      # https://stackoverflow.com/a/74982013
      # if you only want to allow requests from only one origin, you can update alloworiginlist. This will only affect storage endpoint
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolalloworiginlist=*
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolallowmethods=*
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolallowheaders=*
      # adjust maxage acc. to your needs
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolmaxage=86400 
      - traefik.http.middlewares.supabase-storage-cors.headers.addvaryheader=true
    
      - traefik.http.routers.supabase-storage.middlewares=supabase-storage-cors,strip-storage-prefix

      # https://stackoverflow.com/a/74982013
      # if you only want to allow requests from only one origin, you can update alloworiginlist. This will only affect storage endpoint
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolalloworiginlist=*
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolallowmethods=*
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolallowheaders=*
      # adjust maxage acc. to your needs
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolmaxage=86400 
      - traefik.http.middlewares.supabase-storage-cors.headers.addvaryheader=true
    
      - traefik.http.routers.supabase-storage.middlewares=supabase-storage-cors,strip-storage-prefix

      # https://stackoverflow.com/a/74982013
      # if you only want to allow requests from only one origin, you can update alloworiginlist. This will only affect storage endpoint
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolalloworiginlist=*
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolallowmethods=*
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolallowheaders=*
      # adjust maxage acc. to your needs
      - traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolmaxage=86400 
      - traefik.http.middlewares.supabase-storage-cors.headers.addvaryheader=true
    
      - traefik.http.routers.supabase-storage.middlewares=supabase-storage-cors,strip-storage-prefix

I

IseOP•7/2/25, 3:47 PM

The label accesscontrolalloworiginlist can accept https://justware.it or is better to write [https://justware.it]?

Software House | Just Ware

Scopri come Just Ware trasforma le idee in realtà con soluzioni digitali per aziende e scuole: web, app, metaverso, IA e formazione. Contattaci subito!

I

IseOP•7/2/25, 3:53 PM

Can I write:

traefik.http.middlewares.supabase-storage-cors.headers.accesscontrolalloworiginlist=https://justware.it/**,https://*.justware.it
?

IIse The label accesscontrolalloworiginlist can accept https://justware.it or is bett...

I

inder•7/2/25, 6:09 PM

It'll be comma separated values.

I

inder•7/2/25, 6:10 PM

accesscontrolalloworiginlist=https://app.example.com,https://admin.example.com

accesscontrolalloworiginlist=https://app.example.com,https://admin.example.com

accesscontrolalloworiginlist=https://app.example.com,https://admin.example.com

accesscontrolalloworiginlist=https://app.example.com,https://admin.example.com

IIse Can I write: - traefik.http.middlewares.supabase-storage-cors.headers.accesscont...

I

inder•7/2/25, 6:11 PM

No, I don't think you can use wildcards here. It will either be

*

* or a specific list

I

inder•7/2/25, 6:12 PM

Keep this in mind that this origin list will only work for /storage/v1 endpoint. If you want to specify for other endpoints, then you'll have to modiy kong config

I

IseOP•7/2/25, 11:29 PM

Thanks!

I

IseOP•7/4/25, 10:17 AM

Is correct? Because it doesn't work

message.txt2.38KB

I

IseOP•7/4/25, 10:32 AM

I think the problem is related to the createSignedURL function of supabase

I

IseOP•7/4/25, 10:32 AM

I

IseOP•7/4/25, 10:32 AM

If I use getPublicUrl I don't have any error or problem

IIse const signedUrl = useCallback( async (download = false) => { ...

I

inder•7/4/25, 10:44 AM

What error did you get in console?

I

IseOP•7/4/25, 10:52 AM

POST https://supabase.justware.it/storage/v1/object/sign/public-files/Corso%20STEM.pdf 400 (Bad Request)

I

IseOP•7/4/25, 10:53 AM

This is the object of the response of the function createSignedUrl:
{
"data": null,
"error": {
"name": "StorageApiError",
"message": "Object not found",
"status": 400
}
}

I

IseOP•7/4/25, 10:54 AM

The file I want is called "Corso Stem.pdf" and it's in a public bucket named "public-files"

I

IseOP•7/4/25, 10:54 AM

If I use getPublicUrl I don't get any error

I

inder•7/4/25, 10:58 AM

I'll have to test this. createSignedUrl factors in RLS policies and getPublicUrl doesn't do any verification.

I

inder•7/4/25, 10:59 AM

This is not related to config in docker-compose

I

IseOP•7/4/25, 11:07 AM

My mistake, I forgot to set the RLS policies for the bucket. Sorry

I

IseOP•7/4/25, 11:07 AM

Now It seems to work fine

Problem with Storage

Similar Threads

Similar Threads

Similar Threads