I have a Rest API with some configuration for the CORS. I cannot use * so I need to specify a list of origins that can access the app. I have a Parameter called AllowedOrigins which is http://localhost:4200,http://somethingelse.com
Resources:
RestApi:
Type: AWS::Serverless::Api
Properties:
StageName: Prod
Cors:
AllowOrigin: !Sub "'${AllowedOrigins}'"
AllowHeaders: "'Content-Type'"
AllowCredentials: true
MaxAge: "'3600'"
The OPTIONS method returns the headers but I get this error:
Access to XMLHttpRequest at 'https://myApi.execute-api.eu-west-1.amazonaws.com/Prod/cars' from origin 'null' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost:4200,http://somethingelse.com', but only one is allowed.
How can I filter the Access-Control-Allow-Origin to only send one value?