‫So now let's talk about CORS.
‫CORS is Cross-Origin Resource Sharing.
‫And this is something you need to know
‫at the exam for one question.
‫Now, I'm gonna go in depth to how that works
‫and that will make answering that question very easy.
‫So, the origin is a scheme, a protocol
‫a host, a domain, and a port.
‫For example, if you look at https://www.example.com
‫the implied port is 443 for HTTPS,
‫the protocol is HTTPS itself
‫and the domain of course is www.example.com
‫Now, CORS is a web browser based mechanism of security
‫to allow or to deny request
‫to other origins while visiting the main origin.
‫So, let's have a look at what the same origin means.
‫So, it's the same origin if we have the same scheme,
‫the same host and the same port.
‫For example, we have these two URLs,
‫they're share the same origin.
‫But, we can have different origins.
‫For example, www.example.com and other.example.com
‫And so, if our web browser is visiting one website
‫and supposed to make a request
‫to another website as part of the request scheme
‫then these requests will not be fulfilled
‫unless the other origin allows
‫for the request using the CORS header.
‫They're called the Access-Control-Allow-Origin headers.
‫So, let's go through a diagram to understand how that works
‫and how they can be leveraged.
‫So, we have a web server and that's your origin
‫and it's https://www.example.com and a web browser.
‫And the second web server, which is the cross-origin, okay?
‫So, www.other.com
‫Now, the web browser is going to do an HTTPS request
‫into the first origin web server.
‫And as part of the result
‫the index that HTML file retrieved is gonna say,
‫Hey, you must also get some images, for example,
‫from this other web server.
‫So, the web browser has a security built in,
‫and first is going to do a pre-flight request
‫to the cross-origin.
‫So, it's gonna say, Hey, I wanna get the options
‫for www.other.com
‫And, by the way, my origin where the request is coming from
‫is the https://www.example.com.
‫And then the web server, if it's considered
‫and configured to use the Cross-Origin Resource Sharing
‫is going to say, Yes, I do allow this origin,
‫the example.com origin, for the get, put and delete methods.
‫So, this is what we call the CORS headers.
‫And, if the web browser is happy with this CORS
‫headers, then the web browser is going
‫to make a request to the other server
‫to retrieve these files
‫and make these calls.
‫So, how does it apply to Amazon S3?
‫Well, if a client makes a cross-origin request
‫on our S3 buckets,
‫we need to enable the correct CORS headers.
‫It's a very popular exam question,
‫and one way to do it very quickly is to allow
‫for a specific origin or to allow for*,
‫that means all origins.
‫So, let's have a look.
‫We have a web browser and we have an S3 bucket,
‫which has a static website being enabled.
‫So, that's my bucket HTML.
‫And we are storing our assets, our images
‫in another S3 bucket called my-buckets-assets.
‫And again, we have enabled a static website for it.
‫So, the web browser goes to the first S3 bucket
‫and say, Hey, I want to get the index,
‫that HTML file, for this URL right here
‫which is, of course, the static website URL.
‫So, we get back the index.html
‫and within the index.html there is an image
‫and that image lives on another website.
‫So, we get the images/coffee
‫this is the web browser doing its thing,
‫but this time it's saying, Hey
‫the target host is this other website,
‫but the origin is this first website.
‫And if the S3 bucket is not configured
‫to have the correct CORS headers
‫it's going to refuse the request,
‫or else if it's allowing this request,
‫then it's going to have the correct headers
‫and say, Okay, you can do this request
‫and you can get the image.
‫So remember, CORS is a web browser security that allows you
‫to enable images or assets or files being retrieved
‫from one S3 bucket in case the request is originating
‫from another origin.
‫So, that's it.
‫I hope you liked it, and I will see you in the next lecture
‫for some hands on
‫to show you exactly how CORS works.