I've been attempting to setup authenticated browser downloads for files within our GCS buckets, but cannot make this work. Users with READER ACL permissions always receive Forbidden/403.
The section on Cookie-based authentication, states this should work, as does this on Authenticated Browser Downloads.
I tried creating a project level IAM entry for the user@domain.com with Storage Object Viewer and a Custom Role for the storage.objects.get permission.
Then tried directly setting the user@domain.com READ permission on the bucket and on the file directly, both via the Console and via:
gsutil acl ch -u user@domain.com:R gs://<bucket>
gsutil acl ch -u user@domain.com:R gs://<bucket>/file
I've also tried to set default ACLs.
I'm testing the downloads from a different browser (tried both Chrome and Safari).
When I request the https://storage.cloud.google.com/<bucket>/file, I am prompted to authenticate but always receive the Forbidden/403.
Is there a way to see where/why the permission is being denied ? What am I missing ?