# Browser: Access to fetch at 'https://storage.googleapis.com/bucket/file' from origin 'https://app.example.com' has been blocked by CORS policy

**Code:** `CORS: No Access-Control-Allow-Origin (Cloud Storage)` · **Category:** Google Cloud / Firebase · **Seen on:** Google Cloud

A browser upload/download to Cloud Storage was blocked because the bucket's CORS configuration doesn't allow your origin, method or headers.

## Meaning

Set a CORS policy on the bucket with the exact origin, methods (including OPTIONS preflight needs) and `responseHeader` entries such as `Content-Type`. Apply with `gcloud storage buckets update --cors-file`. Mind that CORS applies to the XML/JSON API endpoints you actually call, and can be cached for `maxAgeSeconds`.

## Common causes

- No CORS config on the bucket
- Origin not listed (http vs https, trailing slash, port)
- Required headers missing in responseHeader
- Method not allowed (PUT, POST)
- Cached old CORS response

## Quick fix

1. Create `cors.json` and apply it
2. Include `Content-Type` in `responseHeader`
3. Test with `curl -I -H "Origin: https://app.example.com" ...`

## Detailed fix by platform

### gcloud

1. `gcloud storage buckets update gs://BUCKET --cors-file=cors.json`

## Code examples

### cors.json

```json
[{
  "origin": ["https://app.example.com"],
  "method": ["GET", "PUT", "POST"],
  "responseHeader": ["Content-Type"],
  "maxAgeSeconds": 3600
}]
```

## How to diagnose

1. **Origin** — Exactly listed?
2. **Method/headers** — Allowed?
3. **Cache** — maxAge?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/gcp/gcs-cors-preflight-failure)