All Products
Search
Document Center

Object Storage Service:Cross-origin resource sharing (PHP SDK V2)

Last Updated:Aug 05, 2025

Due to the same-origin policy of browsers, cross-origin requests may be rejected when data is exchanged or resources are shared between different domain names. This topic describes how to configure cross-origin resource sharing (CORS) rules. In the CORS rules, you can specify the domain names from which requests can be sent, the methods that can be used to send cross-origin requests, and the allowed headers.

Usage notes

  • The sample code in this topic uses the China (Hangzhou) region (cn-hangzhou) as an example. By default, a public endpoint is used. If you want to access OSS from other Alibaba Cloud products in the same region, use an internal endpoint. For more information about the mappings between OSS regions and endpoints, see OSS regions and endpoints.

  • To set CORS rules, you must have the oss:PutBucketCors permission. To obtain CORS rules, you must have the oss:GetBucketCors permission. To delete CORS rules, you must have the oss:DeleteBucketCors permission. For more information, see Attach a custom policy to a RAM user.

Examples

Configure CORS rules

The following sample code provides an example on how to configure a CORS rule for a bucket: 

<?php // Introduce autoload files to load dependent libraries. require_once __DIR__ . '/../vendor/autoload.php'; use AlibabaCloud\Oss\V2 as Oss; // Specify descriptions for command line parameters. $optsdesc = [ "region" => ['help' => The region in which the bucket is located.', 'required' => True], // (Required) Specify the region in which the bucket is located. "endpoint" => ['help' => The domain names that other services can use to access OSS', 'required' => False], // (Optional) Specify the endpoint that can be used by other services to access OSS. "bucket" => ['help' => The name of the bucket, 'required' => True], // (Required) Specify the name of the bucket. ]; // Generate a long options list to parse the command line parameters. $longopts = \array_map(function ($key) { return "$key:"; // Add a colon (:) to the end of each parameter to indicate that a value is required. }, array_keys($optsdesc)); // Parse the command line parameters. $options = getopt("", $longopts); // Check whether the required parameters are configured. foreach ($optsdesc as $key => $value) { if ($value['required'] === True && empty($options[$key])) { $help = $value['help']; echo "Error: the following arguments are required: --$key, $help"; // Specify that the required parameters are not configured. exit(1); } } // Obtain the values of the command line parameters. $region = $options["region"]; // The region in which the bucket is located. $bucket = $options["bucket"]; // The name of the bucket. // Use environment variables to load the AccessKey ID and AccessKey secret. $credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider(); // Use the default configurations of the SDK. $cfg = Oss\Config::loadDefault(); // Specify the credential provider. $cfg->setCredentialsProvider($credentialsProvider); // Specify the region. $cfg->setRegion($region); // Specify the endpoint if an endpoint is provided. if (isset($options["endpoint"])) { $cfg->setEndpoint($options["endpoint"]); } // Create an OSSClient instance. $client = new Oss\Client($cfg); // Create a GetBucketCorsRequest object to configure a CORS rule for the bucket and specify the allowed sources and request methods for CORS. $request = new Oss\Models\PutBucketCorsRequest(bucket: $bucket, corsConfiguration: new Oss\Models\CORSConfiguration( array( new Oss\Models\CORSRule( allowedOrigins: ['*'], // Allow a cross-origin request from all sources. allowedMethods: ['PUT', 'GET'] // Specify the allowed request methods for CORS. ) ) ) ); // Use the putBucketCors method to configure CORS configurations for the bucket. $result = $client->putBucketCors($request); // Display the returned result. printf( 'status code:' . $result->statusCode . PHP_EOL . // The returned HTTP status code. 'request id:' . $result->requestId // The request ID of the request, which is the unique identifier of the request. );

Query CORS rules

The following sample code provides an example on how to query the CORS rules of a bucket: 

<?php // Introduce autoload files to load dependent libraries. require_once __DIR__ . '/../vendor/autoload.php'; use AlibabaCloud\Oss\V2 as Oss; // Specify descriptions for command line parameters. $optsdesc = [ "region" => ['help' => The region in which the bucket is located.', 'required' => True], // (Required) Specify the region in which the bucket is located. "endpoint" => ['help' => The domain names that other services can use to access OSS', 'required' => False], // (Optional) Specify the endpoint that can be used by other services to access OSS. "bucket" => ['help' => The name of the bucket, 'required' => True], // (Required) Specify the name of the bucket. ]; // Generate a long options list to parse the command line parameters. $longopts = \array_map(function ($key) { return "$key:"; // Add a colon (:) to the end of each parameter to indicate that a value is required. }, array_keys($optsdesc)); // Parse the command line parameters. $options = getopt("", $longopts); // Check whether the required parameters are configured. foreach ($optsdesc as $key => $value) { if ($value['required'] === True && empty($options[$key])) { $help = $value['help']; echo "Error: the following arguments are required: --$key, $help"; // Specify that the required parameters are not configured. exit(1); } } // Obtain the values of the command line parameters. $region = $options["region"]; // The region in which the bucket is located. $bucket = $options["bucket"]; // The name of the bucket. // Use environment variables to load the AccessKey ID and AccessKey secret. $credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider(); // Use the default configurations of the SDK. $cfg = Oss\Config::loadDefault(); // Specify the credential provider. $cfg->setCredentialsProvider($credentialsProvider); // Specify the region. $cfg->setRegion($region); // Specify the endpoint if an endpoint is provided. if (isset($options["endpoint"])) { $cfg->setEndpoint($options["endpoint"]); } // Create an OSSClient instance. $client = new Oss\Client($cfg); // Create a GetBucketCorsRequest object to query the CORS configurations of a bucket. $request = new Oss\Models\GetBucketCorsRequest(bucket: $bucket); // Use the getBucketCors method to query the CORS configurations of the bucket. $result = $client->getBucketCors($request); // Display the returned result. printf( 'status code:' . $result->statusCode . PHP_EOL . // The returned HTTP status code. 'request id:' . $result->requestId . PHP_EOL . // The request ID of the request, which is the unique identifier of the request. 'cors:' . var_export($result->corsConfiguration, true) // The CORS configurations of the bucket. );

Delete CORS rules

The following sample code provides an example on how to delete all CORS rules of a bucket: 

<?php // Introduce autoload files to load dependent libraries. require_once __DIR__ . '/../vendor/autoload.php'; use AlibabaCloud\Oss\V2 as Oss; // Specify descriptions for command line parameters. $optsdesc = [ "region" => ['help' => The region in which the bucket is located.', 'required' => True], // (Required) Specify the region in which the bucket is located. "endpoint" => ['help' => The domain names that other services can use to access OSS', 'required' => False], // (Optional) Specify the endpoint that can be used by other services to access OSS. "bucket" => ['help' => The name of the bucket, 'required' => True], // (Required) Specify the name of the bucket. ]; // Generate a long options list to parse the command line parameters. $longopts = \array_map(function ($key) { return "$key:"; // Add a colon (:) to the end of each parameter to indicate that a value is required. }, array_keys($optsdesc)); // Parse the command line parameters. $options = getopt("", $longopts); // Check whether the required parameters are configured. foreach ($optsdesc as $key => $value) { if ($value['required'] === True && empty($options[$key])) { $help = $value['help']; echo "Error: the following arguments are required: --$key, $help"; // Specify that the required parameters are not configured. exit(1); } } // Obtain the values of the command line parameters. $region = $options["region"]; // The region in which the bucket is located. $bucket = $options["bucket"]; // The name of the bucket. // Use environment variables to load the AccessKey ID and AccessKey secret. $credentialsProvider = new Oss\Credentials\EnvironmentVariableCredentialsProvider(); // Use the default configurations of the SDK. $cfg = Oss\Config::loadDefault(); // Specify the credential provider. $cfg->setCredentialsProvider($credentialsProvider); // Specify the region. $cfg->setRegion($region); // Specify the endpoint if an endpoint is provided. if (isset($options["endpoint"])) { $cfg->setEndpoint($options["endpoint"]); } // Create an OSSClient instance. $client = new Oss\Client($cfg); // Create a DeleteBucketCorsRequest object to delete the CORS configurations of the bucket. $request = new Oss\Models\DeleteBucketCorsRequest(bucket: $bucket); // Use the deleteBucketCors method to delete the CORS configurations of the bucket. $result = $client->deleteBucketCors($request); // Display the returned result. printf( 'status code:' . $result->statusCode . PHP_EOL . // The returned HTTP status code. 'request id:' . $result->requestId // The request ID of the request, which is the unique identifier of the request. );

References