Does allowing the wedding-app origin in R2 CORS authorize every visitor to upload?
No. CORS controls browser cross-origin behavior. The application still needs to authorize the user and grant valid storage permission for the intended upload.
Explore This Question
Search for additional explanations using these tools:
More FAQs in What CORS settings are required for browser-based uploads?
The URL may be expired, its method may differ, or signed headers may not match the request. Inspect the actual upload alongside the CORS preflight.
Use a separate development bucket and its own allowed origins. Production CORS should match the real application origins needed for the deployed user flow.
Still have questions?
Browse all our FAQs or reach out to our support team