Hi all, question on CORS. Why do we have to config...
# helpa
arda
10/12/2021, 2:20 PMHi all, question on CORS. Why do we have to configure it in both Api construct and lambda responses? Are they for different purpose?
t
thdxr
10/12/2021, 2:21 PMI don't think you need to configure it in the lambda response
a
arda
10/12/2021, 2:21 PMi was following this guide: https://serverless-stack.com/chapters/handle-cors-in-serverless-apis.html
t
thdxr
10/12/2021, 2:23 PMah - I believe you can do all the settings in the api if you want and they will apply globally. This example shows setting some globally and setting others on the specific endpoint through the lambda
a
arda
10/12/2021, 2:23 PMi see. that makes sense
s
Slawomir Stec
10/12/2021, 2:55 PMFor ‘Enabling CORS support for Lambda or HTTP proxy integrations’ it is required
Slawomir Stec
10/12/2021, 2:55 PMSlawomir Stec
10/12/2021, 2:55 PMIf you use REST API
Slawomir Stec
10/12/2021, 2:56 PMSlawomir Stec
10/12/2021, 2:59 PMIn such scenario, it is not enough to set CORS on API level only, CORS headers must be included in the response
a
arda
10/12/2021, 3:12 PMthanks for the info. But I wonder what is API level setting’s role in this case? Do they serve like a pre-filter before forwarding the request to corresponding lambda?
arda
10/12/2021, 3:14 PMso if it is set false, then it would include CORS headers without invoking lambda. But if it is set to true, then it requires lamda functions to return the said headers?
s
Slawomir Stec
10/12/2021, 3:20 PMAccording to the AWS doc in the link it is how API Gateway treat response in the proxy case, this fragment:
Slawomir Stec
10/12/2021, 3:20 PMFor a Lambda proxy integration or HTTP proxy integration, you can still set up the required OPTIONS response headers in API Gateway. However, your backend is responsible for returning the Access-Control-Allow-Origin and Access-Control-Allow-Headers headers, because a proxy integration doesn't return an integration response.
Slawomir Stec
10/12/2021, 3:21 PMFor other integration types I think API level CORS config can be used