Browser: Access to fetch at 'https://storage.googleapis.com/bucket/file' from origin 'https://app.example.com' has been blocked by CORS policy

Meaning

Set a CORS policy on the bucket with the exact origin, methods (including OPTIONS preflight needs) and responseHeader entries such as Content-Type. Apply with gcloud storage buckets update --cors-file. Mind that CORS applies to the XML/JSON API endpoints you actually call, and can be cached for maxAgeSeconds.

Common causes

• No CORS config on the bucket
• Origin not listed (http vs https, trailing slash, port)
• Required headers missing in responseHeader
• Method not allowed (PUT, POST)
• Cached old CORS response

Detailed fix by platform

Code examples

[{
  "origin": ["https://app.example.com"],
  "method": ["GET", "PUT", "POST"],
  "responseHeader": ["Content-Type"],
  "maxAgeSeconds": 3600
}]

How to diagnose

1. Origin — Exactly listed?
2. Method/headers — Allowed?
3. Cache — maxAge?

More related errors