What you would like to accomplish:

The customer expect any requests from localhost or localhost:5000 to succeed, and this should be present in the CORS header.

The URL that should work is:
https://storage.cloud.google.com/bucket_name/object

The solution provided as per the public documentation[1] states, is to use an API that does not work with browsers.

Going to https://bucket-name.storage.googleapis.com/object

Returns "Access Denied. Anonymous caller does not have storage.objects.get access to the Google Cloud Storage object. Permission 'storage.objects.get' denied on resource (or it may not exist)."

Because it ignores Auth Cookies.

The same is true with https://storage.googleapis.com/bucket-name/object (Access Denied).

Only https://storage.cloud.google.com/<BUCKET_NAME> supports cookie-based authentication that works in the browser. Only the browser needs CORS. So setting CORS only really affects this endpoint.

How this might work:

This will allow customers to get Access-Control-Allow-Credentials header as CORS credentials

If applicable, reasons why alternative solutions are not sufficient:

Current functionality didn't allow customers to get Access-Control-Allow-Credentials header as CORS credentials

Links:

[1]https://cloud.google.com/storage/docs/using-cors#troubleshooting

Issue 333569581

Links (5)

Issue metadata