title: AWS S3 Not Sending Access-Control-Allow-Origin header when Origin header on request is present
body: <p>I have an AWS S3 bucket with the following CORS policy:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"&gt;
      &lt;CORSRule&gt;
          &lt;AllowedOrigin&gt;*&lt;/AllowedOrigin&gt;
          &lt;AllowedMethod&gt;GET&lt;/AllowedMethod&gt;
          &lt;AllowedHeader&gt;*&lt;/AllowedHeader&gt;
          &lt;ExposeHeader&gt;Access-Control-Allow-Origin&lt;/ExposeHeader&gt;
      &lt;/CORSRule&gt;
  &lt;/CORSConfiguration&gt;
  </code></pre>
  
  <p>In my app, I load a page of images from the bucket. The images appear on the page as expected. When I click on one of the images to open it in the Adobe Creative SDK, the SDK fails to load the image because it is blocked by CORS. The SDK takes the url of the image and loads it via AJAX. The SDK has an option to enable CORS and appears to be sending the proper <code>Origin</code> header (See screenshot), however AWS is not including the <code>Access-Control-Allow-Origin-Header</code>, causing the image to be blocked by CORS.</p>
  
  <p>I've scoured every question on here about this subject and it seems like no one has a straight answer. There are dozens of questions on this subject that are unanswered, however in many of those cases it appears that the AJAX request isn't sending the Origin header or that the bucket isn't properly configured. In this case, neither of those are true, which is why <strong>this is not a duplicate</strong>.</p>
  
  <p>As you can see in the screenshot, the request includes the <code>Origin</code> header, but the response does not include the <code>Access-Control-Allow-Origin</code> header. What I would like to know is:
   1. Why isn't S3 sending the proper header if my bucket is properly configured?
   2. Is it possible that when the Adobe Creative SDK requests the image via AJAX, the browser sees that the image is already cached and tried to serve the cached image (which doesn't have the <code>Origin</code> header) instead?
   3. If #2 is the case, how can I forcibly add the <code>Origin</code> header to the image request? In the app, the image is the background of a div (css <code>background-image</code> property).</p>
  
  <p><a href="https://i.stack.imgur.com/zVnTE.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/zVnTE.png" alt="enter image description here"></a></p>