For Fabrice, the headers he wants

headers.md

#Call to i.cdpn.io

This is what we have now:

curl -i -D- -o/dev/null -H "Origin: http://codepen.io" http://i.cdpn.io.s3.amazonaws.com/5.ucBde.4d9702ae-058b-4249-b03a-76319088194a.png

Notice the response does not include Access-Control-Expose-Headers

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0HTTP/1.1 200 OK
x-amz-id-2: VKL7/27DIFMxkTHyMN1M4wNWkgnu3UqRB3hQym9pEUCJpTiPrC2jpHQLCdsS9nkU
x-amz-request-id: 8C3FE4536BC6C6CD
Date: Wed, 28 Aug 2013 20:13:39 GMT
Cache-Control: public
Expires: Wed, 27 Aug 2014 22:33:45 GMT
Last-Modified: Tue, 27 Aug 2013 22:33:46 GMT
ETag: "5bf4a54e75ed8a9d56693b3711b4192b"
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 22405
Server: AmazonS3

#Call to i.l.cdpn.io

This is our test bucket, for local development. Notice the headers have been added.

curl -i -D- -o/dev/null -H "Origin: http://codepen.io" https://s3-us-west-2.amazonaws.com/i.l.cdpn.io/28572.ImLpr.tiny.35c2574d-be11-4b79-9307-fc34e09d54f4.png

The result

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0HTTP/1.1 200 OK
x-amz-id-2: nyccRDwuOKYgPwqSPibP+aokr1Al3U0xgLjGdXDiQuLgtXID3zkqV/C7TN0IE9AW
x-amz-request-id: ADBF191DB4533384
Date: Wed, 28 Aug 2013 20:14:00 GMT
Access-Control-Allow-Origin: http://codepen.io
Access-Control-Allow-Methods: GET
Access-Control-Expose-Headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
Access-Control-Max-Age: 3000
Access-Control-Allow-Credentials: true
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Cache-Control: public
Expires: Wed, 27 Aug 2014 21:16:58 GMT
Last-Modified: Tue, 27 Aug 2013 21:16:59 GMT
ETag: "7150af1e25c33b621e5c485d242fa4c5"
Accept-Ranges: bytes
Content-Type: image/png
Content-Length: 1661
Server: AmazonS3

Access-Control-Allow-Origin: http://codepen.io should include http://s.codepen.io . The Access-Control-Expose-Headers look good.