Browser uploads and CORS
Why your buckets need a CORS rule before browser uploads work, how quickS3 sets one up for you, and how to write the rule by hand instead.
When you upload a file in quickS3, your browser sends it straight to your storage provider. Browsers only allow that if the bucket says it accepts requests from quickS3. That permission is the bucket’s CORS rule.
CORS doesn’t make a bucket public and doesn’t give anyone access. It only tells browsers that quickS3 is allowed to talk to the bucket. Who can do what is still decided by your access key and quickS3’s roles.
Let quickS3 set it up
Every connection has Allow quickS3 to update bucket CORS settings (recommended), which is on unless you switch it off. With it on, quickS3 adds its rule to each bucket’s CORS settings when you save the connection, create a bucket, or run Test connection. It keeps any rules the bucket already has.
To check it worked, run Test connection. You want “CORS allows direct uploads” in the result.
For this to work, the connection’s key needs permission to read and change the bucket’s CORS settings. The provider guides say what that permission is called.
Set it up by hand
If your team manages bucket settings some other way, switch the toggle off and add this rule to every bucket the connection uses:
| Setting | Value |
|---|---|
| Allowed origin | https://quicks3.com |
| Allowed methods | GET, HEAD, PUT (on Azure, add OPTIONS) |
| Allowed headers | * (on Azure: content-type,x-ms-blob-type) |
| Exposed headers | ETag |
| Max age | 3600 seconds |
Keep the rules that are already there, and run Test connection afterwards. Copy-paste versions for each provider are in the AWS, Cloudflare R2, DigitalOcean, Google Cloud, and Azure guides.
You don’t need DELETE. Deletes go through quickS3, not the browser.
Symptoms of a CORS problem
| You see | Likely cause |
|---|---|
| Test connection warns “CORS does not allow…” | The rule is missing, or the key couldn’t add it. |
| Every upload fails straight away with a network error | Same: the browser is blocking the upload. |
| Large uploads reach 100% and then fail | ETag isn’t in the exposed headers. |
| Downloads open in a new tab instead of saving | GET isn’t allowed for quickS3. |
| A 403 or “access denied” error | Not CORS. The key or your role doesn’t allow it. CORS can’t fix that. |
Whatever the symptom, never make the bucket public to fix it.