Serverless AWS Access-Control-Allow-Headers in preflight response

user_13099722 0
Viewed 206

For some reasom this error appears from nowhere:

has been blocked by CORS policy: Request header field x-company-id is not allowed by Access-Control-Allow-Headers in preflight response.

Here is my serverless.yml lambda function:

  healthPlan:
    handler: src/handlers/health-plan.healthPlanHandler
    events:
      - http:
          path: /health-plan
          method: get
          cors:
            origin: ${self:custom.allowed-origin}
            allowCredentials: ${self:custom.allow-credentials}
            headers:
              - Content-Type
              - X-Amz-Date
              - Authorization
              - X-Api-Key
              - X-Amz-Security-Token
              - X-Amz-User-Agent
              - X-Company-Id
              - x-company-id
          authorizer:
            authorizerId: ${cf:auth-service-${self:provider.stage}.ApiAuthorizer}
            type: TOKEN

I'm new to serverless. Could someone give me advice or the answer for current situation? Where should I look? Thanks a lot for help!

serverless amazon-web-services header lambda
1 Answers

Firstly, are you sure you need x-company-id? I see you have also X-Company-Id, which I'm guessing might be the actual header AWS expects?

Likely x-company-id is being treated as a custom header. I had this same CORS issue with Serverless and AWS when trying to pass actual custom headers to my API.

My issue was resolved by adding a resources section to serverless.yml to include CORS headers in API Gateway-level error responses and including CORS headers in the normal responses of my lambda handler.

The instructions for performing these 2 steps I found here: https://dev.to/leventov/enable-cors-with-custom-headers-for-an-aws-lambda-function-behind-api-gateway-in-serverless-framework-3702

Note that, instead of including each header explicitly in the access-control-allow-headers field, you can also just whitelist all headers with * if this is not a security concern.

user_75959620
Related