I encountered an issue while implementing cloudfront signed cookies.
When trying to access '' from '', the CORS policy blocked it due to absence of the 'Access-Control-Allow-Origin' header.
This problem arose after restricting viewer access (using Signed cookie) for the cloudfront distribution on Domain 1(a.xyz.com) when requested from Domain 2(b.xyz.com).
The S3 CORS configuration for the bucket containing assets from domain 1 is as follows:
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>*</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<AllowedMethod>PUT</AllowedMethod>
<AllowedMethod>POST</AllowedMethod>
<AllowedMethod>HEAD</AllowedMethod>
<MaxAgeSeconds>3000</MaxAgeSeconds>
<AllowedHeader>*</AllowedHeader>
</CORSRule>
</CORSConfiguration>
I have attempted adding whitelist headers in the cloudfront behavior settings, such as :
Access-Control-Request-Headers
Access-Control-Request-Method
Origin
However, the error persists despite these adjustments.
Note: Opening the file in a new tab works fine, with signed cookies generated successfully.
How can this issue be resolved?