tencent cloud

Implementation Notice for Security Management of COS Bucket Domain (Effective January 2024)
Download PDF
Last updated: 2025-09-09 17:27:45
Implementation Notice for Security Management of COS Bucket Domain (Effective January 2024)
Last updated: 2025-09-09 17:27:45
Download PDF
From January 1, 2024, to ensure the security and stability of the overall service, Cloud Object Storage (COS) will impose the following limits on bucket domain name usage:
COS buckets created after January 1, 2024 cannot use path-style domain names.
For COS buckets created after January 1, 2024, if you use COS default domain to access objects, preview is not supported for any type of file, and download is not supported for apk and ipa files.

Not Supported Path-Style Domain Name

Storage buckets created after January 1, 2024 do not support path-style domain names and only support using virtual-hosted-style domain names. Buckets created earlier are unaffected, but we recommend prioritizing virtual hosted style domain names.
Domain Name Format
Example
path-style
cos.<Region>.myqcloud.com/<BucketName-APPID>
virtual-hosted-style
<BucketName-APPID>.cos.<Region>.myqcloud.com

Default Domain Name Not Supported for Preview, Apk and Ipa File Download Not Supported

For buckets created after January 1, 2024, when users use default domain names (including default bucket domain, static website domain, and global acceleration domain) to access files, any type of file will not support preview but will be directly downloaded. COS will add two headers in the response headers: 
x-cos-force-download:true
Content-Disposition: attachment
For buckets created after January 1, 2024, if users use the default domain name (including the default bucket domain name, static website domain, or global acceleration domain) to access APK or IPA files (file suffix .apk or .ipa), the download request will return an error. Example error information:
HTTP/1.1 403 Forbidden

<?xml version="1.0" encoding="UTF-8"?>
<Error>
    <Code>DownloadForbidden</Code>
    <Message>The APK/IPA file is not allowed to be distributed in a public network using COS default domain, please use custom domain instead.</Message>
</Error>
If you wish to preview files or download apk and ipa objects in the bucket directly through a browser, access the objects through custom domain name. For more information, please refer to enable custom origin site domain.
For buckets created before January 1, 2024, the preview and download actions via the default bucket domain name are not affected, but we recommend prioritizing the use of a custom domain name.
Was this page helpful?
You can also Contact Sales or Submit a Ticket for help.
Yes
No

Feedback