I'm using Amplify, and have my API Gateway proxying to Lambda. I've enabled CORS on my /{proxy+} and deployed the API. In my Lambda function, I'm setting the appropriate header in my trivial function:
import json
def handler(event, context):
print("received event:")
print(event)
return {
"statusCode": 200,
"headers": {
"Access-Control-Allow-Credentials": True,
"Access-Control-Allow-Headers": "Content-Type",
"Access-Control-Allow-Methods": "OPTIONS,POST,GET",
"Access-Control-Allow-Origin": "*",
},
"body": json.dumps(event),
}
This Lambda function sits behind an API Gateway resource which is authenticated via Cognito.
When I invoke my API using Amplify:
let myInit = {
headers: {
Authorization: `Bearer ${(await Auth.currentSession())
.getIdToken()
.getJwtToken()}`
}
};
API.get("adminapi", "/admin", myInit) ...
I get the dreaded CORS header 'Access-Control-Allow-Origin' missing from my GET request:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://xxxxxxxxxx.execute-api.us-east-1.amazonaws.com/dev/admin. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).
I see it returned in the OPTIONS request:
I even tested in Postman to verify the headers are coming back:
What am I doing wrong here? It doesn't look like the call is getting past API Gateway. I wonder if it has to do with authentication. When I test from Postman using my IAM credentials it works fine, but from my web app using the bearer token it fails as above.
