I’m developing a simple web app using HTML and vanilla JavaScript. The app allows users to upload an image, which is then sent to Firebase Storage. My web app is hosted at https://esstsas.net.
The Problem:
When I try to upload an image to my Firebase Storage bucket (gs://checksst-faster.firebasestorage.app), the request fails with a CORS preflight error in the browser console:
Access to XMLHttpRequest at ‘…’ from origin ‘https://esstsas.net‘ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: It does not have HTTP ok status.
This is the relevant JavaScript code that handles the image upload: I am using the Firebase JS SDK (v11.6.1). The storage object has been correctly initialized.
JavaScript
// This function is called when the "Save" button is clicked
async function saveInspection() {
const file = lastSelectedFile; // lastSelectedFile is the user's selected image File object
const userId = auth.currentUser.uid;
if (!file || !userId) {
console.error("File or User ID is missing.");
return;
}
try {
console.log("Step 1: Resizing image...");
const resizedImageBlob = await resizeImage(file); // Resizes image to a Blob
console.log("Step 2: Uploading to Storage...");
const fileName = `${Date.now()}-${file.name}`;
const storageRef = ref(storage, `images/${userId}/${fileName}`);
// This is the line that fails
const uploadTask = await uploadBytes(storageRef, resizedImageBlob);
console.log("Step 3: Getting download URL...");
const downloadURL = await getDownloadURL(uploadTask.ref);
// ... code to save the downloadURL to Firestore would go here
console.log("Upload successful:", downloadURL);
} catch (error) {
console.error("DETAILED UPLOAD ERROR:", error);
}
}
What I’ve already tried (Troubleshooting Steps):
I am certain this is not a simple configuration error because I have performed extensive troubleshooting:
-
CORS Configuration: I used the
gcloudCLI to set the CORS policy on my bucket. The commandgsutil cors get gs://checksst-faster.firebasestorage.appconfirms the policy is set correctly with my origin:[{"origin": ["https://esstsas.net", "https://www.esstsas.net"], "method": ["GET", "POST", "OPTIONS"], ...}] -
Wildcard Test: As a test, I also applied a wildcard policy with
"origin": ["*"]. The error still persisted. -
Client-Side Caching: I have ruled out browser caching by performing a hard refresh (Ctrl+Shift+R), testing in incognito mode, using a completely different browser, and testing on a different network (mobile hotspot).
-
Firebase Rules: My Firestore and Storage security rules are correctly configured to allow access for authenticated users (
allow read, write: if request.auth != null && request.auth.uid == userId;).
Even with the server-side CORS configuration confirmed as correct and after eliminating all client-side caching possibilities, the browser still receives a failed preflight response. I cannot create a formal Google Cloud support ticket as I am on the free plan.
Is there any other project-level setting, network issue, or known bug that could be overriding the bucket’s CORS policy?