Docs

Torch Object Storage

Bucket CORS

PutBucketCORS

Introduction

This interface sets Cross-Origin Resource Sharing (CORS) rules for a bucket. You can use the Content-MD5 header to provide the expected MD5 value, which will be compared with the MD5 of the uploaded object; if they do not match, an error will be returned.

warning

If you want to set CORS rules for the bucket, your account must have tos:PutBucketCORS permission. For details, see the Access control.

TOS supports setting multiple CORS rules, but the total size of all rules cannot exceed 20KiB.

Request syntax

Request parameters and headers

This request uses common request headers. See Common parameters.

Name	Location	Type	Required	Sample value	Note
cors	Query	String	Yes	-	Identifies a PutBucketCORS request.
Content-MD5	Header	String	No	XrY7u+Ae7tCTyyK7j1rNww==	Base64-encoded MD5 digest of the message body.

Request body elements

Name	Type	Required	Example value	Note
CORSRules	Array	Yes	-	The CORS rule information.
AllowedOrigins	Array	Yes	["*"]	Specify the allowed origins of cross-origin requests. Constraints: List IP addresses or domain names, optionally with port numbers. Must include https:// or http://. Multiple entries are allowed, with one entry per line separated by line breaks. Each line can contain at most one wildcard (*).
AllowedMethods	Array	Yes	["PUT", "GET"]	Specify the allowed cross-origin request methods, one or more can be specified, including PUT, GET, POST, DELETE, and HEAD.
AllowedHeaders	Array	No	["Authorization"]	Specifies the allowed cross-origin request headers. Constraints: Multiple entries are allowed, with one entry per line separated by carriage returns. Set to * by default unless otherwise required, indicating all are allowed.
ExposeHeaders	Array	No	["x-tos-request-id"]	Specify additional headers in CORS responses exposed to clients to provide extra information. Constraints: Multiple headers can be specified, one per line, separated by line breaks. Wildcards (*) are not allowed. warning It is generally recommended to add the X-Tos-Request-Id and ETag headers.
MaxAgeSeconds	Integer	No	1024	Indicates how long the results of an OPTIONS request can be cached, in seconds. The default is 3600.
ResponseVary	Bool	No	false	Return Vary: Origin header? false (Default): Does not return Vary: Origin header. true: Returns Vary: Origin header. warning Enabling Return Vary: Origin may increase the number of visits or CDN back-to-origin requests.

Response headers

The public response headers returned by this request, see Common parameters.

Response body elements

No elements are used.

Sample request 1

Configure a CORS rule for the bucket.

Sample response 1

Sample request 2

Configure the bucket to allow cross-origin PUT and POST requests from http://www.example.com and enable the return of the Vary: Origin header. MaxAgeSeconds helps prevent browsers from sending OPTION requests for the same request.

Sample response 2

Last updated: 2026.08.03 10:27:38