Enable CORS on Google Storage Signed URL for my item object

Question

I enabled CORS in my bucket on the Google Cloud Storage; for now I added a wildcard (*) for any origin and method but still receiving "Origin 'https://my-app.net' is therefore not allowed access".

In resume, all objects in my bucket are not public but my server using the c# Google Cloud library return a signed URL to the client which redownload it again using $http.get to save server bandwidth and memory.

If I use window.open with the signed URL everything works (*user need to allow pop up) but if I use $HTTP.get of angularjs with the signed URL from the browser, I receive CORS error despite having enabled CORS on my bucket

I did see this on the Google documentation related to signed URL:

If the request is scoped to a subresource, such as ?cors, add this subresource, including the question mark, to the end of the string.

Be sure to copy the HTTP request path literally: that is, you should include all URL encoding (percent signs) in the string that you create. Also, be sure that you include only query string parameters that designate subresources (such as cors). You should not include query string parameters such as ?prefix, ?max-keys, ?marker, and ?delimiter.

Is this some kind of setting to enable CORS with signed url? Can I achieve this with the c# Google Cloud Storage library?

Answer 1

Alright, i found why it didn't work.

First, i would suggest to anyone having problems with CORS to test it with a simple project. I did a simple Angular 6 project and i was able to download my PDF using "http.get".

Here the problem we had; we currently have an interceptor services which append an "Authorization" header for all request.

I made an exception for any request that include "storage.googleapis" to NOT include the "Authorization" headers. Now everything works fine there was nothing to do with the signed URL, the signed URL was just fine.