Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user wants to enable.

To me, such conservative defaults and fine-grained settings suggest that there is some reason that I might not want to let all of my buckets respond with Access-Control-Allow-Origin: *, but for the life of me I can't think of a single way it could be abused.

S3 already provides a fairly elaborate ACL policy, and users cannot authenticate via cookies (as far as I know), so the problem doesn't seem to be people getting to information they shouldn't be able to get to.

S3 also provides an entirely separate way to block access to certain domains entirely, including for plain old image tags, so it doesn't seem to be an issue of hotlinking.

Is there any risk at all to a super-open CORS policy?

share|improve this question

Considering the rationale for the same-origin policy, it would be good to consider whether an attacker could exploit Access-Control-Allow-Origin: * by using a cookie saved in the user's browser to access the S3 site.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.