https://serverless-stack.com/ logo
Join Slack
Powered by
how do you guys have CORS configured to only allow...
# help
a
how do you guys have CORS configured to only allow your prod URL and local dev environment? Adding "localhost" to the config doesn't seem to work.
Or do you just allow origin "*" for non-prod stage somehow? If so, how?
k
import * as apig from "@aws-cdk/aws-apigatewayv2-alpha" ... this.api = new sst.Api(this, "Api", { ... cors: { allowOrigins: [process.env.ORIGINS], allowHeaders: ["*"], allowMethods: [apig.CorsHttpMethod.POST, apig.CorsHttpMethod.GET, apig.CorsHttpMethod.PUT, apig.CorsHttpMethod.DELETE], }, you can set proces.env.ORIGINS to a secret or however your pulling secrets.
a
@Kristian Lake so for local dev environment you have 
ORIGINS="*"
and for prod environment you have 
ORIGINS="<http://myapp.com|myapp.com>"
?
k
a
ah, I see...but why not just put both into allowOrigins array and remove the env var?
k
you can do that. I have to refactor my origins soon 🙂
a
but does that localhost config really work? I tried just "localhost" yesterday, and it didn't work. Not sure why yours should work and mine shouldn't. Either both should, or none, imo. "localhost" is a valid host name.
ah, I think I see the problem
I didn't have "OPTIONS" method in allowedMethods array, and S3 is doing an OPTIONS request first
weird that setting the hosts to * solved that problem, though
actually, no, scratch that, you can't put OPTIONS in that array, it's not allowed
what the heck, it seems to work now by just having localhost there in the array. I must have messed up something else yesterday. Or maybe there was a cache issue somehow. But it works now
aaah, how frustrating. I cleared the cache and it stopped working. So it actually was a cache issue, but an inverse one, so that it doesn't work until the browser has the response already cached
which obviously only happened now because I added * yesterday as a text, which then made it work and the browser cached it
so it now also worked with localhost, but only because it was still cached from yesterday
@Kristian Lake 
<http://localhost:3000>
in AllowedOrigins seems to work, thx
I don't understand why localhost alone or even localhost:3000 doesn't work, but whatever
ok it seems the protocol is always needed in allowedOrigins
not just for localhost, but also other domains
f
@Adrian Schweizer just confirming on this, according to their doc, 
ORIGIN
always contain the protocol part https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#preflighted_requests
Open in Slack
PreviousNext
Powered by