Hi everyone, I'm trying to make CORS work on my API. I have enabled cors on it and all the routes use AWS_IAM authorization.

cors: true,
defaultAuthorizationType: ApiAuthorizationType.AWS_IAM,

The problem is that I need to add a route that calls into a lambda in order to handle the preflight calls.

'OPTIONS /{proxy+}': {
          function: 'src/functions/api/options.main',
          authorizationType: ApiAuthorizationType.NONE,
        },

The lambda simply returns the proper headers:

return {
    statusCode: 204,
    body: '',
    headers: {
      'Access-Control-Allow-Origin': '*',
      'Access-Control-Allow-Methods': '*',
      'Access-Control-Allow-Headers': '*',
    },
  };

It does work, but I hate the fact that I need to manage my own lambda to do CORS. Anyone here got it working without having to go through all this? I suppose there is a way to add a route to the sst.API without specifying an integration right? (I can do that using the console) Any help would be greatly appreciated.

sst.API

should not require any CORS whatsoever from routes,

HTTP API

handles this all on it’s own.

Is that route public? aka is there any auth on it?

yes. a JWTAuthorizer.

I see. I had a JWTAuthorizer on it at some point too and it worked. I think it might be related to AWS_IAM auth then

possibly, I have never used it, but it would kind of make sense that you wouldnt be able to have IAM credentials in the browser…thinking that through though…

Well, I am using Cognito through amplify

and using like…an identity pool rather than the JWTs?

exactly

i have not heard of a setup like that before. I have things that are similar, but always server-side.

It is a bit new to me too.

I dont know about nice, but it is cheap and does the job, so long as you dont mind crappy docs and inconsistent interfaces. 😅

True that!

FWIW, I just use the tried and true cognito method, with JWTs, and that works really well with the JWT authorizer. Was a super pain to setup (docs), but once its up, never touched, and I have only had to rip it down and redeploy twice due to Cognito not being able to be configured after the fact (docs misled me).

That's good advice

Its the way all the docs are written, almost nothing uses identity pools. I have some for really weird, non-user facing corner cases, but would not recommend them unless AWS says you have to use them.

Interesting. I will look into it for sure.