0

I'm trying to authorize API Gateway requests for a Lambda Proxy Integration resource using a Cognito User pool.

From the client, all requests work fine without an Authorizer. When I add an Authorizer, GET requests work when authorized, but a POST/PUT/DELETE request gives me this error:

401 Access to XMLHttpRequest at [Endpoint] from origin [client] has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource

I have selected 'Enable CORS' for the resource but it still won't work.

js request:

const jwt = this.$store.state.user
        .getSignInUserSession()
        .getIdToken()
        .getJwtToken();

const config = {
        headers: {
          authorization: jwt,
        },
        id: generatedID,
        name: 'generatedName',
      };

      axios.post(endpoint, config)
        .then((val) => { this.info = val; })
        .catch(err => console.log(err));

auth config: authorizer config

If I change request type from POST to GET, it works. If I remove the Authorizer from API Gateway, it works. What am I missing for POST/PUT/etc?

I want to get a 200/201 response and for the request to pass API Gateway authorization.

Nik
  • 2,004
  • 2
  • 16
  • 23
Matingcall
  • 1
  • 2
  • For Lambda Proxy Integration, you would need to manually add CORS headers in the Lambda response. Kindly refer to this [documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-lambda-proxy-integrations.html). – Arka Mukherjee Apr 18 '19 at 21:54
  • @lightyagami The lambda function already does that, but logs indicate that the lambda function isn't even being hit. Only the API shows any activity in cloudwatch, and it indicates only that the request is 'unauthorized' and stops there. – Matingcall Apr 18 '19 at 23:21
  • https://stackoverflow.com/questions/38987256/aws-api-gateway-cors-post-not-working – Chetan Ranpariya Apr 19 '19 at 02:51

2 Answers2

0

This issue can be fixed by adding preflight 'OPTIONS' to the API Gateway as explained in this documentation.

After adding the preflight entry, api gateway should look like the screenshot.

https://enable-cors.org/server_awsapigateway.html

Robin Varghese
  • 889
  • 8
  • 18
0

If I change request type from POST to GET, it works.

That may be because when you do that it becomes a 'simple request' and it won't do a pre-flight OPTIONS request which fails in your case because of the Authorizer.

If I remove the Authorizer from API Gateway, it works. What am I missing for POST/PUT/etc?

The OPTIONS request fails to pass the Authorizer control, if you remove the Authorizer it works.

The full solution to your issue can be found here

Vue & Axios + AWS API Gateway & Lambda - CORS + POST not working

Summarizing. If you have a

route       verb            Authentication      integration
/private    POST/GET        yes                 lambda-private

Then you need to create an extra

route       verb            Authentication      integration
/private    POST/GET        yes                 lambda-private
/private    OPTIONS         no                  lambda-CORS-response

So your pre-flight request will get a nice response and the POST/GET request will hit your desired destination.

Rub
  • 790
  • 8
  • 15