I’m getting a very odd combination of CORs issues when trying to do a fetch request for an object hosted in R2 (Cloudflare S3 equivalent):

• If I disable cache in devtools:

Then, I have no CORs issues.

Similarly, if I disable the cache then re-enable it, I have no issues. But … if I “clear the browser cache”, then refresh the page, I’ll get CORs issues.

This is happening when trying to do a fetch request for an R2 bucket with the following CORs policy:

[
  {
    "AllowedOrigins": [
      "https://localhost:3000",
      "http://localhost:3000"
    ],
    "AllowedMethods": [
      "GET",
      "HEAD",
      "POST",
      "PUT",
      "DELETE"
    ],
    "AllowedHeaders": [
      "*"
    ],
    "ExposeHeaders": [
      "*"
    ],
    "MaxAgeSeconds": 3600
  }
]

which should allow all CORs requests. What could be happening?

One thing to note — Cloudflare only returns the proper CORs headers if the request contains the Origin header.