Configure CORS response headers on AWS Lambda?

Question

I'm trying to create a new service using AWS API Gateway, but I found out the browser automatically calls OPTIONS method in order to obtain CORS information.

The problem is that AWS API Gateway does not offer a native way to configure CORS headers.

Is it possible to create a Lambda Script in order to respond to OPTIONS method?

Answer 1

If you have lambda-proxy enabled, you need to set the CORS headers manually:

module.exports.hello = function(event, context, callback) {

    const response = {
      statusCode: 200,
      headers: {
        "Access-Control-Allow-Origin" : "*", // Required for CORS support to work
        "Access-Control-Allow-Credentials" : true // Required for cookies, authorization headers with HTTPS
      },
      body: JSON.stringify({ "message": "Hello World!" })
    };

    callback(null, response);
};

https://serverless.com/framework/docs/providers/aws/events/apigateway#enabling-cors

Answer 2

Here is a sample, I hope this helps you:

...
    return {
        statusCode: 200,
        headers: {
            "Access-Control-Allow-Headers" : "Content-Type",
            "Access-Control-Allow-Origin": "*", // Allow from anywhere 
            "Access-Control-Allow-Methods": "GET" // Allow only GET request 
        },
        body: JSON.stringify(response)
    }
}

For more information please check this link: https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-cors.html

Answer 3

If you're using JQuery $.ajax, it will send the X-Requested-With with the POST following the OPTIONS request, so you need to make sure when setting up your OPTIONS access-control-accept-headers on AWS API to include that header: X-Requested-With along with the others.

Answer 4

I have a solution for HTTP API Gateway with ANY method. If you use authorizer on ANY method, your authorizer will reject the OPTIONS request as it doesn't contain an Authorization/Bearer token. Solution is simple: Next to the ANY route, create OPTIONS route with the very same path and no authorizer, pointing to lambda function. Then in lambda, add

const headers = {
    "Content-Type": "application/json",
    "Access-Control-Allow-Origin": "*",
    "Cache-Control": "max-age=0, no-store, must-revalidate",
    Pragma: "no-cache",
    Expires: 0
};
data = {
        multiValueHeaders: {},
        isBase64Encoded: false,
        statusCode: 200,
        headers: headers,
        body: ""
    }
if (event.httpMethod == "OPTIONS") {
    return context.done(undefined, data)
}

This worked for me.