I am trying to set up a user upload system that goes directly to Google Storage rather than have content pass through our server. To do that, we have the front-end first contact the server for a signed url and then send the file upon receiving that url. That all seems to be working. After getting the URL back, the front end then sends a PUT request to Google Storage. 

Due to CORS, the initial options payload is sent and gets a 200 response. However, the following (example) upload gets a 403 with the following message and I am baffled as to why:

> 
> Access to XMLHttpRequest at
>  '<https://storage.googleapis.com/spaceofmotion/2019-06-23/finish-getup-agile.mp4?Expires=1561322797&GoogleAccessId=admin-275%40spaceofmotion.iam.gserviceaccount.com&Signature=BikemcQ%252BNe6L8mqLeSplKSz9L6baZhf9Mntc%252BR%2FQVGtAiY0XTlGTSb9wSaVuDd9zfoW%252BdrN4Za8O%252BTvbSm4cx%2FrH4Ub%2FFa2BnqNB74HlpNoFSLjXRe1bqatjCThsWTuR%252B5ADHHfQeen5eGyPPHFwNar5fSgCbd6Cf3kwIkvPSRgltHUymGtlDLHwhguopi83%2FY7t8jKocEc%252ByEx1eSW6PPlPY3qvDINbaV5NZ2aZ45LZiI7c5yckmoNCvy2kcz2qUvS1bPA%2FUJCD25mda%2FTW1DFGp3T5RWncUVHsxMTt4CzZp7%252BUJNnZ44U1pKd1dU7FGl3t%2FucExuMzGN%2F%2FM4NwMw%253D%253D>'
>  from origin '<http://localhost:3000>' has been blocked by CORS policy:
>  No 'Access-Control-Allow-Origin' header is present on the requested
>  resource.
> 
> 
> 

The bucket is configured as such:

```
[
{"maxAgeSeconds": 30, "method": ["GET", "PUT"], "origin": ["https://www.spaceofmotion.com"], "responseHeader": ["\*"]},
{"maxAgeSeconds": 30, "method": ["GET", "PUT"], "origin": ["http://localhost:3000"], "responseHeader": ["\*"]}
]

```

Here is the initial options [pre-]request:

[![Initial Request](https://i.stack.imgur.com/EXeGp.png)](https://i.stack.imgur.com/EXeGp.png)

And here is the second request:

[![Second request, gets a 403](https://i.stack.imgur.com/Q8cCU.png)](https://i.stack.imgur.com/Q8cCU.png)

What is wrong with this setup?