/// GUIDES / CORS RULES

CORS rules

CORS (Cross-Origin Resource Sharing) is the browser's rule about whether the storafleet web app, running on your machine, is allowed to talk directly to your bucket. You only need it for one optional feature — direct (fast) uploads. Everything else already works without it.

When you need CORS

Most things a Fleet does never touch the browser's cross-origin rules:

• Previews & downloads use short-lived signed links — no CORS.
• Normal uploads stream through storafleet's servers on the way to the bucket — no CORS.
• Direct (fast) uploads send bytes straight from your browser to the bucket. This is the only path that needs a CORS rule.

What a CORS rule contains

A CORS policy is a list of rules. Each rule has these fields:

• AllowedOrigins — which website(s) may drive the browser to the bucket. Use your exact storafleet URL (e.g. https://app.example.com). Never use * here — it would let any site upload to your bucket.
• AllowedMethods — GET (read), PUT (single upload), POST (multipart upload), DELETE (remove), HEAD (existence/size check).
• AllowedHeaders — which request headers the browser may send. ["*"] allows any; or list Content-Type.
• ExposeHeaders — which response headers JavaScript may read back. ETag is required to finish a multipart upload.
• MaxAgeSeconds — how long the browser caches the preflight check (≤ 86400).

The recommended rule

This is exactly what storafleet applies when you click Enable fast uploads. Replace the origin with your storafleet URL:

[
  {
    "AllowedOrigins": ["https://app.example.com"],
    "AllowedMethods": ["GET", "PUT", "POST", "HEAD"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3600
  }
]

Applying it to your bucket

• Let storafleet do it — if your connected credentials can manage bucket settings, use Enable fast uploads (or the CORS tab editor) and we apply the rule for you over the API.
• Paste it yourself — if your credentials can't change bucket settings (for example, a Cloudflare R2 Object Read & Write token), copy the JSON from the CORS tab and paste it into your provider's console.

Provider notes

• Cloudflare R2 — set CORS in R2 → your bucket → Settings → CORS Policy, or use an Admin Read & Write token to manage it from storafleet (an Object Read & Write token can neither read nor write CORS). Origins must be scheme://host[:port] with no trailing slash and no path. R2 accepts ["*"] for headers.
• Wasabi — serves permissive CORS automatically; there's nothing to configure.
• AWS S3 & other S3-compatible — managed from the storafleet CORS editor when the credentials allow s3:GetBucketCors / s3:PutBucketCors.