The answer
Use a separate development bucket and its own allowed origins. Production CORS should match the real application origins needed for the deployed user flow.
What CORS settings are required for browser-based uploads?
Should the production R2 bucket allow every localhost origin for developer convenience?
More FAQs in What CORS settings are required for browser-based uploads?
No. CORS controls browser cross-origin behavior. The application still needs to authorize the user and grant valid storage permission for the intended upload.
The URL may be expired, its method may differ, or signed headers may not match the request. Inspect the actual upload alongside the CORS preflight.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.