fix: validate S3 browser download CORS

2026-07-25 16:53:15 +08:00
parent 9716fc2115
commit 091a0cee75
4 changed files with 80 additions and 1 deletions
--- a/docker/storage/cors.json
+++ b/docker/storage/cors.json
@@ -0,0 +1,11 @@
+{
+  "CORSRules": [
+    {
+      "AllowedOrigins": ["https://tp.workyai.cn"],
+      "AllowedMethods": ["GET", "HEAD"],
+      "AllowedHeaders": ["*"],
+      "ExposeHeaders": ["Content-Disposition", "Content-Length", "Content-Type", "ETag"],
+      "MaxAgeSeconds": 3600
+    }
+  ]
+}
--- a/docker/storage/nginx-files.conf.example
+++ b/docker/storage/nginx-files.conf.example
@@ -25,7 +25,7 @@ server {
    access_log off;

    location / {
-        limit_except GET HEAD {
+        limit_except GET HEAD OPTIONS {
            deny all;
        }