Examkin

Question

Difficulty: HardTroubleshooting API Gateway Errors and CORS

A client-side SvelteKit dashboard application hosted on `https://admin.service.internal` sends a `DELETE` request to an Amazon API Gateway REST API. The request fails, and the browser console displays a CORS preflight error indicating that the `Access-Control-Allow-Origin` header is missing. The REST API is configured with a Lambda Proxy Integration and a custom Lambda Authorizer on the `DELETE` method. The developer has already used the API Gateway Console to enable CORS on the resource, which created an `OPTIONS` method. Which two actions must the developer take to resolve this issue?

  1. Configure the OPTIONS method on the resource to use NONE for its Authorization type in API Gateway, then redeploy the API.Answer
  2. Update the backend Lambda function mapped to the DELETE method to include the Access-Control-Allow-Origin header in the headers object of the returned JSON payload.Answer
  3. C
    Configure an Integration Response in the API Gateway Console for the DELETE method to map the Access-Control-Allow-Origin header to the client's origin.
  4. D
    Modify the custom Lambda Authorizer code to validate the authorization header and return an Allow policy for the OPTIONS method.
  5. E
    Modify the CORS configuration on the S3 bucket where the SvelteKit application is hosted to permit DELETE methods from API Gateway.

Answer

To resolve the CORS preflight block, the developer must set the Authorization type of the OPTIONS method to NONE in the API Gateway Console, and modify the backend Lambda function for the DELETE method to return the Access-Control-Allow-Origin header in its response headers.
CORS preflight (OPTIONS) requests are initiated by the browser to determine whether the target server permits the cross-origin request. Because these preflight requests lack credentials, they cannot pass authorizers. Consequently, the OPTIONS method must have its Authorization set to NONE. Furthermore, under a Lambda Proxy Integration, API Gateway relies entirely on the backend payload structure to formulate the HTTP response. The developer must return the Access-Control-Allow-Origin header directly from the backend Lambda function to satisfy browser security validations during the subsequent DELETE request.

Step-by-Step Solution

1
Disable authorization on the preflight method.
Change the Authorization setting for the preflight OPTIONS method to NONE in the API Gateway Console and redeploy the API. This permits browser preflight checks to pass without requiring authorization tokens.
Browsers perform CORS preflight checks using OPTIONS requests, which do not include authorization credentials.
2
Inject CORS headers into the backend Lambda response.
Modify the Lambda function handling the DELETE method to return 'Access-Control-Allow-Origin': 'https://admin.service.internal' (or '*') in the headers object of the response payload.
When using Lambda Proxy Integration, API Gateway bypasses console integration response headers, meaning the backend code must supply the required CORS headers directly.

Key Concept

Handling CORS preflight authorization and header injection in API Gateway Lambda Proxy integrations.
Estimated Time:3m 0s
Rate this question

Topics

Troubleshooting API Gateway Errors and CORS

More questions from this topic