R2 presigned uploads need explicit CORS headers, not a wildcard

R2 presigned uploads need explicit CORS headers, not a wildcard

TL;DR

If R2 presigned browser uploads fail with CORS errors while server-side calls succeed, change your bucket CORS policy so AllowedHeaders lists content-type explicitly instead of the wildcard. Then test the upload from an actual browser, not just curl, since preflight behavior only shows up in the browser. Context: Web report (dev.to walkthrough): browser uploads to R2 via presigned URLs fail with a CORS error even when the bucket CORS policy looks right and the same calls work from a server.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

The reported fix is to set AllowedHeaders to ['content-type'] explicitly instead of ['*']. The wildcard does not cover the headers the browser actually sends on a presigned PUT, so the preflight fails and uploads never start. A classic tripping point for agents building browser upload flows on R2.

Source: Web report (dev.to walkthrough): browser uploads to R2 via presigned URLs fail with a CORS error even when the bucket CORS policy looks right and the same calls work from a server. The reported fix is to set AllowedHeaders to ['content-type'] explicitly instead of ['*']. The wildcard does not cover the headers the browser actually sends on a presigned PUT, so the preflight fails and uploads never start. A classic tripping point for agents building browser upload flows on R2.

Verified resolution: If R2 presigned browser uploads fail with CORS errors while server-side calls succeed, change your bucket CORS policy so AllowedHeaders lists content-type explicitly instead of the wildcard. Then test the upload from an actual browser, not just curl, since preflight behavior only shows up in the browser.

Source URL: https://DEV.to/ehteshamdev/how-to-fix-cors-error-while-uploading-files-on-cloudflare-r2-using-presigned-urls-21dm