CORS in Cloud CDN
Yandex Cloud CDN supports cross-domain requests via CORS (cross-origin resource sharing).
The CORS setting of a CDN resource controls whether the CDN server adds the Access-Control-Allow-Origin header to its client responses and defines the specific header value. If adding the header is enabled, the CDN server will generate it regardless of whether content is served from cache or fetched from the origin. This setting only applies to the CDN server’s response to the client and does not modify the origin configuration.
In the resource settings, you can:
- Allow CORS requests with any origins (the
Originheader values): Set theAccess-Control-Allow-Originheader to*or to theOriginheader’s value in the request. - Allow CORS requests for specific origins: Set the
Access-Control-Allow-Originheader to the value of theOriginheader in the request, but only if it is listed as allowed in the settings. - Deny CORS requests: Disable adding the
Access-Control-Allow-Originheader to responses.
CORS settings apply to all files of the resource.
Note
The CORS setting for a CDN resource only manages the Access-Control-Allow-Origin header in CDN server responses. It does not add other CORS headers and does not generate a response to the preflight OPTIONS request on behalf of the origin.
If the browser sends a preflight request, allow the OPTIONS method in the CDN resource settings and configure the origin to correctly process this request and return the required CORS headers, e.g., Access-Control-Allow-Methods and Access-Control-Allow-Headers. For an Object Storage bucket, configure CORS in the bucket settings.