Yozamu Comments - Answer Overflow

Yozamu

•Created by Yozamu on 5/24/2024 in #general-help

Questions about CORS and R2 usage

So CORS is indeed controlling access right? I don't understand why it can be used there to poke holes and not "prevent" some stuff. Just because unauthorized requests won't count towards request count is a reason to deny access. My app basically embeds a game, and resources are loaded from there. No reason to make them accessible from somewhere else

9 replies

CDCloudflare Developers

•Created by Yozamu on 5/24/2024 in #general-help

Questions about CORS and R2 usage

(With the sentence "Build rich client-side web applications and selectively allow cross-origin access to your bucket by setting up a CORS policy", I've understood that it was about controlling access)

9 replies

CDCloudflare Developers

•Created by Yozamu on 5/24/2024 in #general-help

Questions about CORS and R2 usage

If CORS does not restrict anything, then I wonder what's its point 🤔 I'll have to dig a bit further. My goal was just to prevent massive requesting from anywhere that wouldn't be my own application. Yes, my issue regarding usage was for both R2 and website, since bucket is new and website isn't shared with anyone. But if R2 usage comes from myself, I'm less worried about web analytics. I was just afraid that I was getting my bucket requests spammed already

9 replies

CDCloudflare Developers

•Created by Yozamu on 5/24/2024 in #general-help

Questions about CORS and R2 usage

Oh right maybe was it too specific to be asked there.. For 1 I've just set something "simple" I guess :

[
  {
    "AllowedOrigins": [
      "https://www.mywebsite.com",
      "https://staging.mywebsite.com"
    ],
    "AllowedMethods": [
      "GET",
      "HEAD"
    ],
    "AllowedHeaders": [
      "Authorization"
    ],
    "ExposeHeaders": [],
    "MaxAgeSeconds": 3000
  }
]

[
  {
    "AllowedOrigins": [
      "https://www.mywebsite.com",
      "https://staging.mywebsite.com"
    ],
    "AllowedMethods": [
      "GET",
      "HEAD"
    ],
    "AllowedHeaders": [
      "Authorization"
    ],
    "ExposeHeaders": [],
    "MaxAgeSeconds": 3000
  }
]

(note: I've never written a CORS policy before) For 2, I've only uploaded once, but maybe each time I click R2 it does list the buckets and/or when I select mine to go check the settings and update them, it would count? 🤔 If so that would be good enough as an explanation, however I still don't get how the analytics points so much requests in germany and USA (among others), where I'm not

9 replies

Gaming

Programming