Starting January 8, 2026, to ensure business security and stability, Volcano Engine Torch Object Storage will restrict the use of buckets' default domain names in China (Hong Kong). Specifically, the direct preview of any type of objects or the download of objects with .apk, .ipa, or .hap suffixes, using default domain names via pre-signed or anonymous access, will be prohibited.

Estimated Change Time

2026-01-08. Please refer to the console for the specific time.

Change Description

For buckets created in China (Hong Kong) on or after January 8, 2026, the following changes will apply.

For pre-signed or anonymous access to objects using default domain names, TOS will automatically include the Content-Disposition: attachment parameter in the response header. This means that objects of any type will download directly to your local device instead of being previewed online.

Accessing objects with .apk, .ipa, or .hap suffixes using a default domain name or pre-signed URL will no longer be permitted. Attempting direct access will result in the following error:

HTTP/1.1 400 Bad Request

{
"Code": "ApkDownloadForbidden",
"RequestId": "c35016853c8ceec656853c8-ac11c259-1r8dDM-LB-cb-tos-front-****",
"HostId": "TQHYhZZTikZoNVVNxzQdLLRFyBLz****",
"Message": "The APK file is not allowed to be distributed in a public network using the TOS endpoint, please use CNAME instead."
}

Impacts

If you want to preview objects directly or download objects with .apk, .ipa, or .hap suffixes, you need to access them through a custom domain. For more information, see Associating a custom domain.

The changes do not affect buckets created before January 8, 2026. However, we recommend using custom domain names to access objects in these buckets.

Last updated: 2025.12.22 11:17:24

Public security network record in Beijing: No. 11010802032137