Can't set CORS to <Origin>*</Origin> when initiating resumable uploads?

[omerzach]

https://cloud.google.com/storage/docs/cross-origin#How_CORS_Works:

When using the resumable upload protocol, the Origin from the first (start upload) request is always used to decide the Access-Control-Allow-Origin header in the response, even if you use a different Origin for subsequent requests. Therefore, you should either use the same Origin for the first and subsequent requests, or if the first request has a different Origin than subsequent requests, use the XML API with the CORS configuration set to *.

I'm initiating resumable uploads from my server, sending the generated upload URL to my clients (web/mobile apps), and then having them actually POST files to Google Cloud Storage. It seems I need CORS configured to <Origin>*</Origin> to support this, but I don't see a way to do so in the SDK. Is there a solution I'm missing?

[lesv]

Take a look at the Cors, Cors.Builder, and Cors.Origin classes in the javadocs

I couldn't find an example, but the tests show creating and setting them.

[omerzach]

Yep I see how to create the Cors policy I need, but not how to associate it with the API request the SDK is making for me?

[omerzach]

Looks like I have the exact same issue as this: danialfarid/ng-file-upload#1192

In their PHP solution they add "Origin" => env('APP_ADDRESS') to their initial call that starts the resumable upload. I'd like to similarly add either * or my specific client address but don't see a way to do this with the SDK.

[lesv]

So, CORS is typically something you set once. (At least as I understand it)

You set CORS on a bucket, and not AFAIK on an object. (Are you thinking something else)?

Bucket.Builder has a cors(Iterable<Cors> cors) method
BucketInfo.Builder also has a cors method.

So, in looking, it appears that you can update a Bucket using a BucketInfo

     Cors cors = Cors.newBuilder()
        .setMaxAgeSeconds(100)
        .setOrigins(origins)
        .setResponseHeaders(headers)
        .setMethods(methods)
        .build();

    String bucketName = "my_unique_bucket";
    BucketInfo bucketInfo = BucketInfo.builder(bucketName).cors(cors).build();
    Bucket bucket = storage.update(bucketInfo);

Note - the cors() method will become setCors() in the next release.

[mziccard]

Hi @omerzach! Are you using google-cloud-java to create the resumable upload URL? If yes, can you share with us the code you are using?

google-cloud-storage uses the JSON api under the hood. AFAIK when you create a resumable upload URL using the JSON api you need to preserve the same Origin that you used for the opening request in all subsequent upload requests.

A possible workaround could be to override the Origin header in the request that opens the resumable URL, as it's done in danialfarid/ng-file-upload#1192. Unfortunately, at the moment google-cloud-storage does not expose such a option. In fact, we do not even expose a method to create a resumable URL in our Storage interface.

[omerzach]

Yeah, looks like that's exactly the issue.

So I guess the only solution is to directly call the endpoint to start the resumable upload with a custom origin instead of using the SDK?

For what it's worth, I'm calling from Scala, not Java, but:

  val options: StorageOptions = StorageOptions.defaultInstance
  val storageRpc = new DefaultStorageRpc(options)

  val storageObject = {
    (new StorageObject)
      .setBucket(bucket)
      .setName(key)
      .setContentType(contentType)
      .setSize(BigInt(contentLength).bigInteger)
  }

  storageRpc.open(storageObject, Map.empty.asJava)

[mziccard]

So I guess the only solution is to directly call the endpoint to start the resumable upload with a custom origin instead of using the SDK?

Yeah that would be your best option for now. Provided the http client lets you override origin (wouldn't give that for granted). Have a look at the code in DefaultStorageRpc.open for an idea of how to open the resumable upload URL.