Storage / Object / Controls / v2026.11
Restrict Cross-Origin Resource Sharing to Approved Origins
CCC.ObjStor.CN12 · Access Control
Ensure that browsers may only make cross-origin requests to a bucket from web origins the organization has approved. No provider rejects such rules natively, so a policy-as-code check on bucket configuration satisfies these requirements.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.ObjStor.CP15 | Cross-Origin Resource Sharing | The service may be configured with a cross-origin resource sharing (CORS) policy on a bucket that determines which web origins a browser is permitted to request objects from. |
| CCC.Core.CP14 | API Access | The service exposes a port enabling external actors to interact programmatically with the service and its resources using HTTP protocol methods such as GET, POST, PUT, and DELETE. |
Related Threats
| ID | Title | Description |
|---|
| CCC.ObjStor.TH07 | Cross-Origin Requests are Permitted from Untrusted Origins | A bucket's cross-origin resource sharing policy may be configured with a wildcard or overly broad list of allowed origins, methods, or headers. Scripts served from an untrusted web origin can then read or write objects from within an authenticated user's browser session. This results in a loss of confidentiality or integrity of objects in the bucket. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.ObjStor.CN12.AR01 | When a cross-origin resource sharing rule is configured on a bucket, the service MUST reject any rule whose allowed origin is a wildcard. | tlp-green, tlp-amber, tlp-red |
| CCC.ObjStor.CN12.AR02 | When a cross-origin resource sharing rule is configured on a bucket, the service MUST restrict the allowed origins to an organization-defined allowlist. | tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| CCM | IAM-01 | IAM Policy and Procedures |