CORS configuration in AWS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CORS stand for and why is it important in web applications?

CORS stands for Cross-Origin Resource Sharing. It allows web browsers to securely request resources from a different domain than the one that served the web page, enabling safe sharing of resources across origins.

beginner

In AWS S3, how do you enable CORS for a bucket?

You enable CORS by adding a CORS configuration XML to the S3 bucket settings. This configuration specifies allowed origins, methods, headers, and max age for requests.

beginner

What is the purpose of the AllowedOrigins element in a CORS configuration?

AllowedOrigins defines which domains are permitted to access the resources. It can be a specific domain or a wildcard (*) to allow all origins.

intermediate

Why should you avoid using a wildcard (*) in AllowedOrigins in production?

Using a wildcard allows any website to access your resources, which can lead to security risks. It's safer to specify only trusted domains.

beginner

What HTTP methods are commonly allowed in CORS configurations for AWS S3?

Commonly allowed methods include GET, PUT, POST, DELETE, and HEAD, depending on the operations your application needs.

Which AWS service commonly uses CORS configuration to control cross-origin requests?

A Amazon EC2

B Amazon S3

C AWS Lambda

D Amazon RDS

Amazon S3 uses CORS configuration to allow or restrict cross-origin requests to buckets.

In a CORS configuration, what does the AllowedHeaders element specify?

A How long the response can be cached

B Which HTTP methods are allowed

C Which domains can access the resource

D Which HTTP headers can be sent with the request

AllowedHeaders specifies which HTTP headers the browser can include in the actual request.

What is the effect of setting AllowedOrigins to "*" in an S3 CORS policy?

A Allows any origin to access the bucket resources

B Blocks all cross-origin requests

C Allows only the origin of the bucket owner

D Requires authentication for all requests

Setting AllowedOrigins to "*" means any website can make cross-origin requests to the bucket.

Which HTTP method is NOT typically included in an S3 CORS configuration?

A PATCH

B POST

C GET

D DELETE

PATCH is not commonly used in S3 CORS configurations; GET, POST, and DELETE are typical.

What does the MaxAgeSeconds setting control in a CORS configuration?

A How long the resource is available

B The timeout for the HTTP request

C How long the browser caches the preflight response

D The maximum size of the request body

MaxAgeSeconds controls how long the browser can cache the preflight OPTIONS request response.

Explain how to configure CORS for an AWS S3 bucket to allow a specific website to access its resources.

Think about the JSON structure that controls origins, methods, and headers.

Describe why CORS is necessary and what security risks it helps to manage.

Consider how browsers protect users and how CORS fits in.