# DeleteBucketCors

DeleteBucketCors deletes a bucket's CORS configuration - every rule at once. When the aim is to
change some rules and keep others, [PutBucketCors](https://docs.strg.com/s3-api/PutBucketCors) with the full new set is
the better fit. Saving an empty rule list in the dashboard does the same as this operation. Once
the rules are gone, web pages on your websites' origins no longer get cross-origin access to the
bucket from the browser. [CORS rules](https://docs.strg.com/cors-rules) explains how they work.

**Info: Good to know on STRG**

- Changing CORS rules is the work of an access key for all buckets.
- `x-amz-expected-bucket-owner` is welcome and has nothing to check.
- On a public bucket, anonymous readers can still get answers carrying the old CORS headers for up
  to 5 minutes after the delete.

## When you'd use it

- A web app that used to take uploads straight from the browser now sends them through its own
  server. Its deploy script deletes the bucket's CORS rules, so no web page can reach the bucket
  directly any more.
- A demo site has been taken down, and the bucket behind it stays on as plain storage. Deleting
  the CORS rules leaves it reachable by signed requests and SDKs, as before, and by no browser
  page.
- An agent that set up CORS rules for a short-lived preview cleans up after itself once the preview
  is over.

## Request

```http
DELETE /?cors HTTP/1.1
Host: my-bucket.s3.eu-central-1.strg.com
Authorization: AWS4-HMAC-SHA256 Credential=...
x-amz-date: 20260926T120000Z
x-amz-content-sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
```

Path-style, the same request is `DELETE /my-bucket?cors` on `s3.eu-central-1.strg.com`. The
[S3 API overview](https://docs.strg.com/s3-api/overview) describes both addressing styles.

### Permissions

The access key needs **Manage buckets** (`buckets:write`), a permission that belongs to keys for
all buckets. A key limited to certain buckets gets `403 AccessDenied`.
[Access keys](https://docs.strg.com/access-keys) has the details.

### URI parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `Bucket` | String | Yes | The bucket whose CORS configuration is deleted. |
| `cors` | Flag | Yes | Selects the CORS subresource. Sent without a value. |

### Request headers

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `x-amz-expected-bucket-owner` | String | No | Welcome, and has nothing to check: an access key only ever reaches its own account's buckets. |

### Request body

None.

## Response

A successful delete answers `204 No Content` with no body - also when the bucket had no CORS
configuration, so running it twice is harmless.

On a bucket with *Bucket Protection* off, anonymous reads of objects stored with a
`Cache-Control` that lets a shared cache keep them may be answered from STRG's cache, which
keeps an answer for at most 5 minutes. For up to **5 minutes** after the delete, such a reader can
still get an answer carrying the old CORS headers. Signed requests are never answered from the
cache. [Anonymous reads](https://docs.strg.com/s3-api/overview#anonymous-reads) has the details.

### Response headers

| Name | Description |
| --- | --- |
| `x-amz-request-id` | The request ID, for support requests. |

### Response body

None.

## Errors

These are the errors this operation can answer, and the situation behind each.

| Code | HTTP status | When |
| --- | --- | --- |
| `NoSuchBucket` | 404 | The bucket does not exist, it is in a region other than the endpoint's, or your account has no storage in this endpoint's region. |
| `AccessDenied` | 403 | The access key lacks **Manage buckets**, or is limited to certain buckets. |
| `InvalidAccessKeyId` | 403 | The access key does not exist, has expired or been revoked, or was created so recently that it is not yet usable in this endpoint's region - a moment later it is. |
| `SignatureDoesNotMatch` | 403 | The request signature is wrong. |
| `RequestTimeTooSkewed` | 403 | The request time is more than 15 minutes from the server's. |
| `AuthorizationHeaderMalformed` | 400 | The signature's credential scope names a region other than the endpoint's. |
| `SlowDown` | 503 | Too many requests at once; a retry after the `Retry-After` interval goes through. |
| `ServiceUnavailable` | 503 | A temporary failure; a retry usually succeeds. |

## Differences from Amazon S3

A few things work a little differently on STRG, each listed here with what it means for your
requests.

| Aspect | Amazon S3 | STRG |
| --- | --- | --- |
| Access key scope | Any identity with `s3:PutBucketCORS` on the bucket | A key for all buckets holding **Manage buckets** |
| Bucket in another region | `301` redirect with `x-amz-bucket-region` | `404 NoSuchBucket`. Each bucket answers on its own regional endpoint. |
| `x-amz-expected-bucket-owner` | Checked against the bucket owner | Welcome, with nothing to check: a key only ever reaches buckets of its own account |
| Public bucket | No response cache in front of the bucket | Anonymous readers can get answers carrying the old CORS headers for up to 5 minutes after the delete |

## Examples

Each example removes every CORS rule from `my-bucket`.

**AWS CLI**

```bash
aws s3api delete-bucket-cors \
  --bucket my-bucket \
  --endpoint-url https://s3.eu-central-1.strg.com \
  --region eu-central-1
```

**Python (boto3)**

```python
import boto3

s3 = boto3.client(
    "s3",
    endpoint_url="https://s3.eu-central-1.strg.com",
    region_name="eu-central-1",
)

s3.delete_bucket_cors(Bucket="my-bucket")
```

**JavaScript (AWS SDK v3)**

```javascript
import { DeleteBucketCorsCommand, S3Client } from "@aws-sdk/client-s3";

const client = new S3Client({
  endpoint: "https://s3.eu-central-1.strg.com",
  region: "eu-central-1",
});

await client.send(new DeleteBucketCorsCommand({ Bucket: "my-bucket" }));
```

## Related

- [PutBucketCors](https://docs.strg.com/s3-api/PutBucketCors)
- [GetBucketCors](https://docs.strg.com/s3-api/GetBucketCors)
- [CORS rules](https://docs.strg.com/cors-rules)
- [Access keys](https://docs.strg.com/access-keys)
- [S3 API overview](https://docs.strg.com/s3-api/overview)