I have come across various discussions and issues related to this topic, but unfortunately, I have not been able to find a solution yet. I am attempting to use AJAX GET to retrieve a file from S3. My bucket is configured for CORS:
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<MaxAgeSeconds>3000</MaxAgeSeconds>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>
Below is a curl snippet for my request (file path omitted):
curl 'https://s3.amazonaws.com/mybucket/myfile.tar.gz
-X OPTIONS
-H 'Access-Control-Request-Method: GET'
-H 'Origin: http://0.0.0.0:9000'
-H 'Referer: http://0.0.0.0:9000/'
-H 'Access-Control-Request-Headers: accept, x-longtostring'
-H 'Pragma: no-cache'
-H 'Accept-Encoding: gzip, deflate, sdch'
-H 'Accept-Language: en-US,en;q=0.8,he;q=0.6,mg;q=0.4'
-H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.125 Safari/537.36'
-H 'Accept: */*'
-H 'Cache-Control: no-cache'
-H 'Connection: keep-alive'
--compressed
--verbose
Unfortunately, I am receiving a 403 error:
HTTP/1.1 403 Forbidden
x-amz-request-id: 1F545B4ED302B3AD
x-amz-id-2: AiQwUgOeVhfxRjYL/13MLBsUQdx8n4bYLhV3TwftDfnMZ+7FhvnxfVAGLCo3WCiT
Content-Type: application/xml
Transfer-Encoding: chunked
Date: Sun, 30 Aug 2015 21:25:17 GMT
Server AmazonS3 is not blacklisted
Server: AmazonS3
<?xml version="1.0" encoding="UTF-8"?>
Connection #0 to host s3.amazonaws.com left intact
<Error><Code>AccessForbidden</Code><Message>CORSResponse: This CORS request is not allowed. This is usually because the evalution of Origin, request method / Access-Control-Request-Method or Access-Control-Requet-Headers are not whitelisted by the resource's CORS spec.</Message><Method>GET</Method></Error>
The issue seems to be resolved when removing -X OPTIONS. However, this is automatically added by the browser (I'm using Angular $http.get), and I do not have control over it (or do I?).
Thank you