---
title: "How to Fix CORS Errors in S3 Buckets | Hostman Docs"
description: "Learn how to fix CORS errors when accessing S3 bucket files from external websites. Step-by-step guide to configuring CORS in Hostman dashboard or via AWS CLI, including rules for origins, methods, headers, and verification."
---

> For the complete documentation index for AI agents, see [llms.txt](https://hostman.com/llms.txt).

When using files from [S3](https://hostman.com/products/s3-storage/) buckets on external resources, such as a website, you might encounter a CORS (Cross-Origin Resource Sharing) error. This error occurs when the browser blocks cross-origin requests to your bucket’s resources. 

To resolve this issue, you need to configure specific CORS rules for the bucket to allow cross-origin requests. You can set up CORS in the Hostman dashboard or via AWS CLI.

## In the Hostman Dashboard

1.  Go to the **S3 storage** section and click on the bucket.
2.  In the **Settings** tab, click **Change** next to the **CORS** parameter.

![Ef1c7645 66e7 4d0f B2e7 98acbf2ef091](https://content.hostman.com/assets/3d436263-9752-4510-b299-1e332dd6429a.png?width=1535&height=868)

3.  Fill in the required CORS rule parameters:
    

-   -   **Allowed Origins** – Specifies the origins from which requests to the bucket are allowed. Example: `https://example.com`. You can use `*` to allow requests from all domains.
    -   **Allowed Methods** – Defines the HTTP methods that are permitted for CORS requests.
    -   **Allowed Headers** – Specifies the headers allowed in requests. Example: `Authorization`, `Content-Type`. You can specify `*` to allow all headers.
    -   **Expose Headers** – A list of headers that will be accessible to the client in the response. By default, access to some headers is blocked by the browser. Example: `ETag`, `x-amz-meta-custom-header`.
    -   **Max Age Seconds** – Defines the time in seconds for which CORS request results can be cached on the client side. Example: `3600` (1 hour).

![Ff387983 Aeb9 4a03 Bbca 81baab6794df](https://content.hostman.com/assets/ceb30dc1-be83-4045-ae13-6c64ba485daf.png?width=1545&height=1040)

You can create multiple rules (e.g., allow different methods for different origins) by clicking **Add Rule**.

4.  Save the changes by clicking **Save**.
    

## Via AWS CLI

Here's how to set up CORS for an S3 bucket using the AWS CLI utility.

### Creating a CORS Rules File

First, create a `cors.json` file with the desired CORS configuration. This file will allow GET and HEAD requests to objects in your bucket. Here's an example:

```shell
{
  "CORSRules": [
    {
      "AllowedHeaders": ["*"],
      "AllowedMethods": ["GET", "HEAD"],
      "AllowedOrigins": ["*"]
    }
  ]
}
```

-   `AllowedMethods`: Specifies the HTTP methods allowed. In this example, GET and HEAD requests are permitted.
    
-   `AllowedOrigins`: `*` means requests are allowed from any domain. To restrict access to a specific domain, replace the asterisk with the domain name. For example, if your website is hosted at `https://example.com`, replace the line with:
    

```shell
"AllowedOrigins": ["https://example.com"]
```

### Uploading CORS Rules to the Bucket

After creating the CORS rules file, upload it to your S3 bucket using the following command:

```shell
aws s3api put-bucket-cors --bucket <bucket_name> --endpoint-url https://s3.hmstorage.net --cors-configuration file://cors.json
```

Replace `<bucket_name>` with the name of your bucket.

### Verifying CORS Rules

To confirm that the CORS rules have been successfully applied, use this command:

```shell
aws s3api get-bucket-cors --bucket <bucket_name> --endpoint-url https://s3.hmstorage.net
```

### Deleting CORS Rules

If you need to remove the current CORS rules, execute the following command:

```shell
aws s3api delete-bucket-cors --bucket <bucket_name> --endpoint-url https://s3.hmstorage.net
```

This command will delete all existing CORS rules for the bucket.