CORS for Multiple Origins

Viewed 26

I am trying to find a way to allow multiple CORS origins using AWS API Gateway. My current solution is almost working but I don't know what I am missing...

I have a GET and OPTIONS method.

enter image description here

My OPTIONS method invokes a CORS validator and I have this code:

    const allowedOrigins = [
    "http://example.com",
    "http://example.com:8080",
    "https://example.com",
    "https?://[a-z]*.?myapp.com",
    "http://localhost:[0-9]*"
];
exports.lambdaHandler = (event, context) => {
    const origin = event.headers.Origin || event.headers.origin;
    let goodOrigin = false;

    if (origin) {
        allowedOrigins.forEach( allowedOrigin => {
            if (!goodOrigin && origin.match(allowedOrigin)) {
                goodOrigin = true;
            }
        });
    }

    context.succeed({
        headers: {
            "Access-Control-Allow-Headers": "Accept,Accept-Language,Content-Language,Content-Type,Authorization,x-correlation-id",
            "Access-Control-Expose-Headers": "x-my-header-out",
            "Access-Control-Allow-Methods": "DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT",
            "Access-Control-Allow-Origin": goodOrigin ? origin : allowedOrigins[0]
        },
        statusCode: 204
    });
};

Works fine and I get the headers:

enter image description here

But my GET does not have any header and I get MissingAllowOriginHeader

How can I pass the Origin header to the Get method without hardcoding in the GET lambda??

My GET Lambda:

  exports.lambdaHandler = async () => {
    console.log('Ping called OK');
    return {
        statusCode: httpStatusCode.OK,
        body: JSON.stringify({ message: 'PING OK' }),
    };
};

enter image description here

0 Answers
Related