CORS 错误：即使我在上传到 Lamda 时在 API 网关和我的 index.js 文件中启用它 function AWS

Question

i am looking to deploy the backend -login functionality using Lamda function i have already deployed frontend(S3-bucket) and backend(RDS-mysql) . i am getting an error when i submit the form with login details, i have also enabled the CORS in AWS API gateway . I am a bit new to AWS so i am not sure if i am missing something here. any suggestion please here.

• Error in console

- index.js i have below code to enable CORS in the backend code

    app.use(
      cors({
        credentials: true, // for cookies
        origin: "*",
        optionsSuccessStatus: 200,
      })
    );

- API-Gateway AWS i enabled the CORS in AWS as well

- Snippet of code from backend index.js which i uploaded to Lamda function , this is the first time so i am not sure if i wrote the code below correct ( before tweaking in below i used it locally and it worked fine the code)

// bring in express
const express = require("express");
const mysqlx = require("mysql");
const jwt = require("jsonwebtoken");
const auth = require("./verifyTokenExisting");
const authNew = require("./verifyTokenNew");
const cors = require("cors");                // also using cors library here
const cookieParser = require("cookie-parser");
const pdf = require("html-pdf");
const pdfTemplate = require("./documents/pdfTemplate");
const fs = require("fs");
const { isContext } = require("vm");

const app = express();
app.use(express.json());
app.use(cookieParser());

app.use(
  cors({
    credentials: true, // for cookies
    origin: "*",
    optionsSuccessStatus: 200,
  })
);
// mysql connection

let connection = mysqlx.createConnection({
  host: "database-x.xxxxxxxxxxx.eu-west-2.rds.amazonaws.com",
  user: "xxxx",
  password: "xxxxxxxxxxxx",
  database: "join_us",
  insecureAuth: true,
});

////!  LOGIN & LOGOUT
exports.handler = (event, contect, callback) => {
  Context.callbackWaitsForEmptyEventLoop = false;
  //app.post("/api/newuser", (req, res) => {
  let x1 = event.body;
  console.log("144", x1);

  if (event.body.logout === false) {
    connection.query("SELECT * FROM  users WHERE email=?;", [x1.email], function (err, results) {
      
          if ((results[0].password == x1.password && results[0].userloginStatus == false) || (results[0].password == x1.password && results[0].userloginStatus == null)) {
            
            const payload = { email: results[0].email };
           // generate new token
            const token = jwt.sign(payload, "lllfasdgfdadsfasdfdasfcadsf");
            //below are the cookies sent to user first time when he log in
            callback(
              null,
              cookie("yogaoutlet_access_token", token, {
                maxAge: 25 * 24 * 60 * 60 * 1000,
                httpOnly: true, // it will enable on frotend-javascript to not have access to cokkies
                 
              })
            );

          
        } else callback(null, redirect("http://localhost:3000/about"));
      }

    
  } 

// if event.body.logout === true then logout the user
else {
    const payload = { email: event.body.email };
    console.log("339x", payload);
    const token = jwt.sign(payload, "lllfasdgfdadsfasdfdasfcadsf");

    callback(null, clearCookie("yogaoutlet_access_token"));
  }
  //});
};

Answer 1

The CORs you setup in API Gateway (from your screenshot) is just for the OPTIONS method. You need to also return 'Access-Control-Allow-Origin' in your GET, POST, PUT, DELETE method as well. Also, you definitely can't use wildcard, "*" and have credentials set to true. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin

If you want to return the CORS via code, you will need to set your method to 'Use Lambda Proxy integration'. Otherwise you'll need to map an HTTP Header to a stageVariable (usually) eg stageVariable.ORIGIN. I guess you could map it to a value in the request, but I think it's safer to map to StageVariable so only your known sites can call your api.

One more thing to note on the Lambda Proxy integration, your code has to handle the whole response. I do my lambdas in Python and my return looks like this:

return {
    'isBase64Encoded': 'false',
    'statusCode': status_code,
    'headers': {
        'Content-Type': 'application/json',
        'Access-Control-Allow-Origin': origin,
        'Access-Control-Allow-Headers': 'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token',
        'Access-Control-Allow-Methods': 'GET,OPTIONS',
    },
    'body': json.dumps(resp)
}