Geek Answers Handbook

AWS API Gateway - CORS "access-control-allow-origin" - multiple entries

I have an AWS Lambda instance that connects to a specific AWS API Gateway. If I enable CORS and give access-control-allow-origin definition of http://example.com , then I can access the Lambda instance from http://example.com . However, if I use https://example.com , it does not work.

So, in AWS, how can I determine the use of multiple access-control-allow-origin values ​​without using a wildcard? I tried using something like *.example.com , but this does not work.

EDIT: If I use '*' as my value on the API gateway, but set the CORS rules on my S3 bucket, will it be safe? Example bucket rules:

 <?xml version="1.0" encoding="UTF-8"?> <CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"> <CORSRule> <AllowedOrigin>http://example.com</AllowedOrigin> <AllowedMethod>GET</AllowedMethod> <AllowedMethod>POST</AllowedMethod> <AllowedMethod>PUT</AllowedMethod> <MaxAgeSeconds>3000</MaxAgeSeconds> <AllowedHeader>*</AllowedHeader> </CORSRule> <CORSRule> <AllowedOrigin>https://example.com</AllowedOrigin> <AllowedMethod>GET</AllowedMethod> <AllowedMethod>POST</AllowedMethod> <AllowedMethod>PUT</AllowedMethod> <MaxAgeSeconds>3000</MaxAgeSeconds> <AllowedHeader>*</AllowedHeader> </CORSRule> <CORSRule> <AllowedOrigin>https://www.example.com</AllowedOrigin> <AllowedMethod>GET</AllowedMethod> <AllowedMethod>POST</AllowedMethod> <AllowedMethod>PUT</AllowedMethod> <MaxAgeSeconds>3000</MaxAgeSeconds> <AllowedHeader>*</AllowedHeader> </CORSRule> </CORSConfiguration>
+6
source share
2 answers

Unfortunately, this is not possible today. The CORS specification does not allow partial wildcards, and the Gateway API currently only allows one static value for a header.

You may be able to overload your OPTIONS method to dynamically return this value based on the header of the incoming host.

+5
source

This has always annoyed CORS if you want to include multiple Origins.

A common workaround on other systems (e.g. express / nginx, etc.) is:

  • check the Origin header sent by the browser
  • check it for a white list.
  • if it matches, return the incoming Origin as the Access-Control-Allow-Origin header, otherwise return the placeholder (default start)

This is not possible if you use CORS support with AWS-Gateway support, since mock integration is used, but it is possible if you write your own code to process the OPTIONS request.

The following is an example of code written using lambda proxy integration:

 const allowedOrigins = [ "http://example.com", "http://example.com:8080", "https://example.com", "https?://[az]*.?myapp.com", "http://localhost:[0-9]*" ]; exports.handler = (event, context) => { const origin = event.headers.Origin || event.headers.origin; var goodOrigin = false; if (origin) { allowedOrigins.forEach( allowedOrigin => { if (!goodOrigin && origin.match(allowedOrigin)) { goodOrigin = true; } }); } context.succeed({ headers: { "Access-Control-Allow-Headers": "Accept,Accept-Language,Content-Language,Content-Type,Authorization,x-correlation-id", "Access-Control-Expose-Headers": "x-my-header-out", "Access-Control-Allow-Methods": "DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT", "Access-Control-Allow-Origin": goodOrigin ? origin : allowedOrigins[0] }, statusCode: 204 }); };

Save this as a function of lambda. To set this in the API Gateway, add the OPTIONS method, and for Integration Request select the Lambda Function with the Use Lambda Proxy integration .

Of course, the disadvantage of this is that you pay for lambda functions, and calling a lambda function is likely to be an additional 50 ms latency compared to mock integration.

+9
source

More articles:


All Articles