For GET only, any site with a file’s URL can already fetch it, and Firebase’s own sample uses *. Listing your origins is tighter and stops other sites reading your files from the browser.

Why do images show but downloads fail?

An img tag doesn’t need CORS to display a file. Reading the bytes in JavaScript, with fetch(), getBlob() or a canvas, does.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.

Firebase Storage CORS Error (getBlob, fetch): Fix

Short answer

Write a cors.json that allows GET from your site’s origins, then apply it to the bucket in your Firebase config with gcloud storage buckets update. Give it a few minutes, then hard refresh and try again. Check the bucket name: new projects use firebasestorage.app, older ones appspot.com.

Rather not fix it yourself? App Fix Ticket starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.

Why the browser blocks the file, and the fix

01
The bucket has no CORS rule
“To download data directly in the browser, you must configure your Cloud Storage bucket for cross-origin access (CORS).” Firebase, Download files on the web (CORS configuration)
New buckets don’t send CORS headers for browser reads. Add a rule for the origins that load files, such as your live domain and localhost.
```
[
  {
    "origin": ["https://yourapp.com", "http://localhost:5173"],
    "method": ["GET"],
    "maxAgeSeconds": 3600
  }
]
```
02
The rule went to a different bucket
“Use the gcloud storage buckets update command with the --cors-file flag” Google Cloud, Set up and view CORS configurations
Apply the file to the exact bucket in your Firebase config. This replaces the bucket’s existing CORS rules, so first check them with gcloud storage buckets describe and keep any you still need in cors.json.
```
gcloud storage buckets update gs://your-project.firebasestorage.app --cors-file=cors.json
```
03
The origin doesn’t match exactly
“The browser receives the response and checks to see if the Access-Control-Allow-Origin value matches the domain specified in the original request.” Google Cloud, Cross-origin resource sharing (CORS)
The origin is the scheme, host and port. https://www.yourapp.com and https://yourapp.com are different origins, and so is a preview domain. List each one you use.
04
The real error is a permission error
Sometimes a CORS error in the console hides a permission or wrong-bucket problem. Check the Network tab: a 403 means fix the Storage rules, a 404 means check the bucket name and file path.

Checked against the vendor’s docs on November 9, 2026: Firebase docs: Download files on the web; Google Cloud docs: Set up and view CORS configurations; Google Cloud docs: Cross-origin resource sharing.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

“Very responsive, attentive to fixing bugs, and completed the project as needed! Thank you!”

A buyer in the United States, July 2022. Shopify on Fiverr

All 127 Fiverr reviews

Firebase Storage errorFirebase Storage: CORS error, no Access-Control-Allow-Origin header

Why the browser blocks the file, and the fix

The bucket has no CORS rule

The rule went to a different bucket

The origin doesn’t match exactly

The real error is a permission error

Rather hand it over?

More on this error

Describe it and get a written quote