CORS Setup

Required for multipart upload and direct browser-to-storage transfers. The browser uploads file parts directly to MinIO/S3 via presigned URLs, so CORS on the storage layer must allow the frontend origin — and must expose the ETag header.

MinIO (Docker Compose — already configured)

minio:
  environment:
    MINIO_API_CORS_ALLOW_ORIGIN: "*"   # tighten in prod

MinIO (Kubernetes)

env:
  - name: MINIO_API_CORS_ALLOW_ORIGIN
    value: "https://s3bear.example.com"

AWS S3

[
  {
    "AllowedOrigins": ["https://s3bear.example.com"],
    "AllowedMethods": ["GET", "PUT", "POST", "DELETE", "HEAD"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 3600
  }
]

aws s3api put-bucket-cors --bucket YOUR_BUCKET --cors-configuration file://cors.json

The ETag header must be exposed — the frontend reads it from each part upload response to assemble the final object. Without it, multipart uploads complete but the file is corrupt. See Troubleshooting.

Related: Uploading Objects · Deployment · Troubleshooting