title: CORS AWS S3 and cloudfront
body: <p>I see different headers returned from the server using curl and browsers(FF and Chrome).</p>
  
  <p>Curl returns CORS headers</p>
  
  <pre><code>curl -X GET -I -H "Origin: https://qa.gameofshred.com"  https://s3-ap-southeast-1.amazonaws.com/gameofshred-qa/site/fontawesome-webfont.912ec66d7572ff821749.svg --verbose
  
  &gt; GET /gameofshred-qa/site/fontawesome-webfont.912ec66d7572ff821749.svg HTTP/1.1
  &gt; User-Agent: curl/7.29.0
  &gt; Host: s3-ap-southeast-1.amazonaws.com
  &gt; Accept: */*
  &gt; Origin: https://qa.gameofshred.com
  &gt; 
  &lt; HTTP/1.1 200 OK
  HTTP/1.1 200 OK
  &lt; x-amz-id-2: m9oDqyGs0K+0IBnygQlGE9IEeVZQcpIf1nYSWYYu5NU5Hu3gNEUy8SfWnO/mFiK8nPIBPlDhWec=
  x-amz-id-2: m9oDqyGs0K+0IBnygQlGE9IEeVZQcpIf1nYSWYYu5NU5Hu3gNEUy8SfWnO/mFiK8nPIBPlDhWec=
  &lt; x-amz-request-id: 135C9D56C2C0D604
  x-amz-request-id: 135C9D56C2C0D604
  &lt; Date: Wed, 19 Apr 2017 02:37:34 GMT
  Date: Wed, 19 Apr 2017 02:37:34 GMT
  &lt; Access-Control-Allow-Origin: *
  Access-Control-Allow-Origin: *
  &lt; Access-Control-Allow-Methods: GET
  Access-Control-Allow-Methods: GET
  &lt; Access-Control-Max-Age: 3000
  Access-Control-Max-Age: 3000
  &lt; Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
  Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
  &lt; Last-Modified: Tue, 18 Apr 2017 23:02:06 GMT
  Last-Modified: Tue, 18 Apr 2017 23:02:06 GMT
  &lt; ETag: "912ec66d7572ff821749319396470bde"
  ETag: "912ec66d7572ff821749319396470bde"
  &lt; Accept-Ranges: bytes
  Accept-Ranges: bytes
  &lt; Content-Type: image/svg+xml
  Content-Type: image/svg+xml
  &lt; Content-Length: 444379
  Content-Length: 444379
  &lt; Server: AmazonS3
  Server: AmazonS3
  </code></pre>
  
  <p>Browsers on the other hand don't contain any CORS headers.</p>
  
  <p>Request:</p>
  
  <pre><code>GET /gameofshred-qa/site/fontawesome-webfont.912ec66d7572ff821749.svg HTTP/1.1
  Host: s3-ap-southeast-1.amazonaws.com
  Origin: https://qa.gameofshred.com
  Accept: */*
  User-Agent: curl/7.29.0
  Cache-Control: no-cache
  </code></pre>
  
  <p>Response:</p>
  
  <pre><code>Accept-Ranges → bytes
  Content-Length → 444379
  Content-Type → image/svg+xml
  Date → Wed, 19 Apr 2017 02:32:37 GMT
  ETag → "912ec66d7572ff821749319396470bde"
  Last-Modified → Tue, 18 Apr 2017 23:02:06 GMT
  Server → AmazonS3
  x-amz-id-2 → O0V/q2q9vSKQgJWKUL8LfsQghKlyBS90fTYDt9TLcgJimjeCUKg57+UwgAnWym8tJRPpGsRutG0=
  x-amz-request-id → 5EA7299EC61D0E86
  </code></pre>
  
  <p>Any explanation? Thanks.</p>
  
  <p>UPD:
  As was suggested I updated cors configuration. It didn't help</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;*&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
      &lt;AllowedMethod&gt;HEAD&lt;/AllowedMethod&gt;
      &lt;MaxAgeSeconds&gt;55&lt;/MaxAgeSeconds&gt;
      &lt;AllowedHeader&gt;Authorization&lt;/AllowedHeader&gt;
  &lt;/CORSRule&gt;
  &lt;/CORSConfiguration&gt;
  </code></pre>
  
  <p>UPD 2:
  The problem apparently was caused by two reasons
  1) CDN caching
  2) Using Postman for checking CORS. Postman(browser version) always substitutes ORIGIN to something like "chrome://extensions...." so we cannot use it for testing.</p>