Question

I have tried as official documentation for CORS fix by serverless & different solutions, but the issue still persists.

What i have done so far is,

1, Set CORS true on all functions.

 events:
  - http:
      path: /api/v1/user/login
      method: post
      cors: true

2, Set authorizer fix for CORS.

 GatewayResponseDefault4XX:
  Type: 'AWS::ApiGateway::GatewayResponse'
  Properties:
    ResponseParameters:
      gatewayresponse.header.Access-Control-Allow-Origin: "'*'"
      gatewayresponse.header.Access-Control-Allow-Headers: "'*'"
      gatewayresponse.header.Access-Control-Allow-Methods: "'*'"
    ResponseType: DEFAULT_4XX
    RestApiId:
      Ref: 'ApiGatewayRestApi'

3, In response header, i have set as,

headers: {
                'Content-Type': 'application/json',
                'Access-Control-Allow-Origin': '*',
                "Access-Control-Allow-Headers": '*',
                'Access-Control-Allow-Credentials': true,
            }

Still am getting issue based on CORS

Error message:

Access to XMLHttpRequest at ’https://xxxxxx.execute-api.us-east-1.amazonaws.com/dev/api/v1/user/login' from origin ‘http://localhost:4200’ has
been blocked by CORS policy: Request header field Access-Control-Allow-Origin is not allowed by Access-Control-Allow-Headers in preflight response.

Answer 1

我不知道这是解决此问题的最佳方法还是正确方法。 但这可行。

我将默认cors值更改为自定义值。

events:
- http:
  path: /api/v1/user/login
  method: post
  cors: true

对此，

events:
  - http:
      path: /api/v1/user/login
      method: post
      cors:
        origin: '*'
        headers:
          - Content-Type
          - X-Amz-Date
          - Authorization
          - X-Api-Key
          - X-Amz-Security-Token
          - X-Amz-User-Agent
          - Access-Control-Allow-Origin 
          - Access-Control-Allow-Credentials
          - Access-Control-Allow-Methods
          - Access-Control-Allow-Headers
        allowCredentials: true
        cacheControl: 'max-age=600, s-maxage=600, proxy-revalidate'

成功了！

Answer 2

Access-Control-Allow-Headers不接受通配符。

如果无法精确设置标头值，只需删除Access-Control-Allow-Headers设置。

Preflight CORS issue on serverless AWS Lamba fucntions.

2 个答案: