Cloud Storage buckets with no CORS configuration set

When a missing CORS policy actually breaks something

Browsers apply the same-origin policy: a script served from https://app.example.com cannot read a response from another domain unless that domain says it may. Google’s CORS overview uses exactly this case, a web app on one host fetching objects from a bucket on storage.googleapis.com, and explains that the browser blocks the request by default.

The endpoint matters. XML API endpoints (storage.googleapis.com/BUCKET and BUCKET.storage.googleapis.com) answer according to the bucket’s CORS configuration. JSON API endpoints always allow CORS with default headers, regardless of what the bucket says, and the authenticated browser download endpoint storage.cloud.google.com does not allow CORS at all. So this finding only has teeth for buckets that browsers hit through the XML API.

Seeing what a bucket allows today

gcloud storage buckets describe gs://BUCKET_NAME --format="default(cors_config)"

Empty output means no CORS rules. A quick browser-side test is the console’s network tab: a failed request with no Access-Control-Allow-Origin header in the response is the symptom.

What makes the rule fire

ZopNight records whether each bucket carries a CORS configuration and raises a low-severity finding when that record is explicitly false. There is no traffic analysis behind it; ZopNight cannot tell whether a browser ever requests the bucket.

When it says nothing

Buckets whose CORS status was not recorded are skipped. Buckets with any CORS rule, even a permissive one, are silent, so this rule will not warn you about an overly broad "*" origin.

A functional gap, not a saving

No cost is attached. The value of the finding is catching a front-end integration that fails in the browser while working perfectly from curl.

Adding a narrow CORS policy

1. Confirm a browser app really reads this bucket cross-origin; if not, dismiss the finding.
2. Write the rules as a JSON list. The gcloud file holds only the list, without a top-level "cors" wrapper, per the configuration examples:

   [
     {
       "origin": ["https://app.example.com"],
       "method": ["GET"],
       "responseHeader": ["Content-Type"],
       "maxAgeSeconds": 3600
     }
   ]

3. Apply it: gcloud storage buckets update gs://BUCKET_NAME --cors-file=cors.json.
4. List named origins rather than "*", and only the methods the app uses.