From 232bfdbfdee1ea3cb3ebbdbdeedfec04fd0e4c99 Mon Sep 17 00:00:00 2001
From: thePR0M3TH3AN <53631862+PR0M3TH3AN@users.noreply.github.com>
Date: Mon, 26 Jan 2026 07:20:08 -0500
Subject: [PATCH] Update R2 CORS guidance for browser uploads

---
 content/upload-content.md | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/content/upload-content.md b/content/upload-content.md
index 3d7402ea..ff8665e8 100644
--- a/content/upload-content.md
+++ b/content/upload-content.md
@@ -25,28 +25,23 @@ To allow your browser to upload files directly to Cloudflare, you must allow Cro
 
 1. Still in your bucket's **Settings** tab, scroll down to **"CORS Policy"**.
 2. Click **"Add CORS Policy"** (or Edit).
-3. Paste the following JSON configuration and **explicitly list every allowed app origin** (the scheme, host, and port must match exactly):
+3. **Important:** Browser uploads use the AWS JavaScript SDK, which sends the `amz-sdk-invocation-id`, `amz-sdk-request`, and `x-amz-user-agent` headers. The simplest working setup is to allow all headers by setting `AllowedHeaders: ["*"]`.
+4. Paste the following JSON configuration and **explicitly list every allowed app origin** (the scheme, host, and port must match exactly):
 
 ```json
 [
   {
     "AllowedOrigins": ["http://127.0.0.1:5500", "https://bitvid.network"],
     "AllowedMethods": ["GET", "PUT", "POST", "DELETE", "HEAD"],
-    "AllowedHeaders": [
-      "authorization",
-      "content-type",
-      "x-amz-*",
-      "x-amz-content-sha256",
-      "x-amz-date"
-    ],
+    "AllowedHeaders": ["*"],
     "ExposeHeaders": ["ETag", "Content-Length", "Content-Range", "Accept-Ranges"],
     "MaxAgeSeconds": 3600
   }
 ]
 ```
-> **Note:** Replace the `AllowedOrigins` values with the exact origins you use in development and production (the scheme and port must match exactly). Set this policy on the **R2 bucket CORS settings**, and remember that uploads go through the **S3 API endpoint** (`<account>.r2.cloudflarestorage.com`), not the public `r2.dev` URL.
+> **Note:** Replace the `AllowedOrigins` values with the exact origins you use in development and production (the scheme and port must match exactly). Apply this policy on the **bucket’s S3 API endpoint**, not just the public URL or custom domain. Uploads go through the **S3 API endpoint** (`<account>.r2.cloudflarestorage.com`), and Cloudflare’s UI does **not** require adding `OPTIONS` to `AllowedMethods`.
 
-4. Click **"Save"**.
+5. Click **"Save"**.
 
 ### 3. Create an API Token