aws apigateway not returning expected preflight headers, CORS

user_3381434 0
Viewed 247

I'm troubleshooting a CORS issue and am currently analyzing the preflight headers.

I'm using an "HTTP" API in aws apigateway (different from what apigateway calls a "REST" api) to connect to a lambda function using the "lambda function" apigateway integration type.

It seems that no matter what I set in the CORS menu for HTTP apis, the preflight Response just doesn't have the headers I think I've enabled.

enter image description here

In the image below from devtools network tab, it's clear that apigateway is responding (hence the apigw-requestid). However, I would expect the Access-Control-Allow-Origin header to be returned too. No such luck.

enter image description here

My $default stage is set to autodeploy.

I have a proper route and integration attached to the lambda, along with the proper http verb (POST in my case).

There's no authorization set.

I've tried returning the proper headers in my lambda itself, but as the aws documentation says, apigateway ignores them and writes its own stuff. (the lambda wasn't even contacted unless I added an OPTIONS route .. which seems unnecessary anyway)

Yes, there are many such questions here, but most direct you to apigateway "REST" apis, not "HTTP."

aws-api-gateway aws-lambda cors amazon-web-services javascript
1 Answers

I have also encountered this problem. I was using Axios and a GET request was working fine, but a PUT request was giving me a CORS error. I had configured CORS in the API Gateway exactly the same as you. Postman was working fine for PUT and GET.

I added the below to my lambda headers and added a route in API Gateway.

headers = {
    "Content-Type": "application/json",
    "Access-Control-Allow-Origin": "*",
    "Access-Control-Allow-Methods": "OPTIONS, GET, PUT",
    "Access-Control-Allow-Headers": "*"
  };

Note that Access-Control-Allow-Methods could not be a * for Safari as it's not supported: Access Control Allow Methods.

user_19353070
Related