Access-Control-Allow-Origin denial despite CORS configuration

Question

I'm trying to load static assets (specifically CSS) from an Amazon S3 server and having trouble with CORS. My S3 CORS configuration looks like this:

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration>
    <CORSRule>
    <AllowedOrigin>https://my.site.com</AllowedOrigin>
    <AllowedMethod>GET</AllowedMethod>
    <AllowedMethod>POST</AllowedMethod>
    <AllowedMethod>PUT</AllowedMethod>
    <AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>

I was under the impression that this would give me the green light, and it works in Chrome and Mozilla, but in Safari I still get the dreaded:

[Error] XMLHttpRequest cannot load https://my.static/files.css. Origin https://my.site.com is not allowed by Access-Control-Allow-Origin.

Are the other necessary configurations that I am missing? Is this a Safari problem that I can't really fix? On a semi-related note, does S3 need rebooted for changes to the CORS config to go into effect?

I've read Understanding XMLHttpRequests Over CORS (responseText) and How does Access-Control-Allow-Origin header work but those reference modifications to the CORS configuration that I believe I have already made.

Access-Control-Allow-Origin denial despite CORS configuration

0 Answers0