Docs

Torch Object Storage

Data security

CORS rules

In the TOS console, you can use cross-origin resource sharing (CORS) rules to secure data transfers across domains (origins). When TOS receives a CORS or OPTIONS request, it reads the CORS rules of the bucket, performs permission checks, and returns the appropriate headers.

Notes

By default, the owner of an account has full permissions. IAM users have no permissions by default. If an IAM user needs to perform any of the following operations, the account owner must grant the user the appropriate permissions using an IAM or bucket policy.

Configure/Delete CORS rules: tos:PutBucketCORS

View CORS configurations: tos:GetBucketCORS

Steps

In the left navigation pane, click Buckets.

In the top menu bar, select the project of the bucket you want to manage.

In the Buckets list, click the bucket you want to manage.

In the left navigation pane, select Permissions > CORS rules. On the CORS rules page, click Create rule.

On the Create CORS Rule page, configure the following parameters:

Parameter	Required	Description
Origin	Yes	Specifies the allowed origins of CORS requests. Constraints: Provided as IP addresses or domain names, with port numbers allowed. Must include https:// or http://. Multiple entries are allowed, with one entry per line separated by carriage returns. Each line can contain at most one wildcard (* ). Up to 1,000 entries can be added.
Operation methods	Yes	Specifies the allowed cross-origin request methods. You can select one or more, including PUT, GET, POST, DELETE, and HEAD.
Allow-Headers	No	Specifies the allowed headers in CORS responses. Constraints: Multiple entries are allowed, with one entry per line separated by carriage returns. Up to 1,000 entries can be added. Recommended to set it to * (all origins), unless otherwise specified
Expose-Headers	No	Specifies which headers can be exposed to the client in CORS responses. Constraints: Multiple entries are allowed, with one entry per line separated by carriage returns. Wildcards (* ) are not allowed.
Cache Max-Age	No	Indicates how long the results of an OPTIONS request can be cached, in seconds. The default is 3,600 seconds.
Return Vary:Origin	No	Sets whether to return the Vary: Origin response header. We recommend enabling Return Vary: Origin when handling both CORS and non-CORS requests from browsers to prevent potential CORS errors. warning Enabling Return Vary: Origin may increase the number of visits or CDN back-to-origin requests.

Click Create.

After creating a CORS rule, you can view it in the CORS rules list.

Next steps

Edit CORS rules: Click Edit in the Actions column of the CORS rule you want to modify.

Delete CORS rules: Click Delete in the Actions column of the rule you want to remove, and confirm the deletion by clicking Delete in the box that appears.

Last updated: 2026.02.10 17:19:53