title: S3 CORS Configuration: restricting to specific domains has no affect?
body: <p>I have a bucket on S3 with everything public, and the following CORS configuration:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;http://example.com&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
      &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
  &lt;/CORSRule&gt;
  &lt;CORSRule&gt;
      &lt;AllowedOrigin&gt;http://localhost:3333&lt;/AllowedOrigin&gt;
      &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
      &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
  &lt;/CORSRule&gt;
  &lt;/CORSConfiguration&gt;
  </code></pre>
  
  <p>With that configuration, I would expect to <strong><em>only</em></strong> be able to get objects when requesting from <code>http://example.com</code> or <code>http://localhost:3333</code>, and receive <code>403</code>s when linking to urls in that bucket from other domains. As it stands, I can still link to audio and image files in that bucket from <code>http://dev.example.com</code> as well as <code>http://localhost:4444</code>.</p>
  
  <p>What am I doing wrong?</p>