# CORS issue using s3 with self hosted instance

**URL:** <https://discourse.asciinema.org/t/cors-issue-using-s3-with-self-hosted-instance/800>\
**Category:** Development\
**Created:** [February 15, 2024, 3:57pm UTC](https://discourse.asciinema.org/t/cors-issue-using-s3-with-self-hosted-instance/800 "2024-02-15T15:57:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![botch](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.asciinema.org/botch/32/511_2.png) [@botch](https://discourse.asciinema.org/u/botch)\
**Post date:** [February 15, 2024, 3:57pm UTC](https://discourse.asciinema.org/t/cors-issue-using-s3-with-self-hosted-instance/800/1 "2024-02-15T15:57:26Z")

</div>

I self-hosted asciinema on [fly.io](https://fly.io), set the s3 env variables, recording and uploading works. Playing the cast gives me this emoji 💥. The issue? Well, in the console, it says it’s a CORS problem.

```auto
Access to fetch at 'https://fly.storage.tigris.dev/asciinema-storage/uploads/asciicasts/30/00/3.cast?Amz-Expires=xSignedHeaders=host&X-Amz-Signature=x' 
(redirected from 'https://my-url.com/a/<secret>.cast') from origin 
'https://my-url.com' has been blocked by CORS policy: 
No 'Access-Control-Allow-Origin' header is present on the requested resource. 
If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

```

Has anyone faced this before? A few things come to mind:

1. public vs private bucket? But I set up the bucket access keys and secret.
2. I am using [fly.io](http://fly.io)’s new s3-compatible storage. Maybe it’s on their end.
3. before switching to s3, I was mounting a local directory (things were playing), so it’s switching to s3 that caused the problem.

Things i have done:

- I tested the s3 link, and I can download or access the file by clicking on the same link with the CORS issue.
- I explored the self hosted docs and all the other docs for `cors` related and searched here no luck
- Perhaps i need to setup Custom TLS certificate as the docs say?

---

<div class="post-metadata">

**Author:** ![ku1ik](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.asciinema.org/ku1ik/32/171_2.png) [@ku1ik](https://discourse.asciinema.org/u/ku1ik)\
**Post date:** [March 7, 2024, 9:38am UTC](https://discourse.asciinema.org/t/cors-issue-using-s3-with-self-hosted-instance/800/2 "2024-03-07T09:38:08Z")

</div>

I don’t think custom TLS cert would help here. The error message you pasted refers to the missing `Access-Control-Allow-Origin` header on responses from Fly. Ideally, you would add your asciinema server domain as allowed origin in Fly’s bucket configuration, but I’m not familiar with Fly and not sure if they support this.