Examkin

Soru

Zorluk: ZorTroubleshooting API Gateway Errors and CORS

A client-side Angular application hosted on `https://claims.healthportal.com` sends a `PUT` request to an Amazon API Gateway REST API secured by a custom Lambda Authorizer. The API is integrated with a backend Lambda function using Lambda Proxy Integration. When users attempt to perform actions with expired session tokens, the application's browser console displays a CORS preflight blocked error, and the request fails without displaying the expected session expiration message to the user. Which actions should the developer take to resolve the CORS preflight blocked error and allow the frontend to receive the correct status codes? (Select TWO.)

  1. A
    Configure the CORS configuration of the Amazon S3 bucket hosting the Angular frontend to allow traffic from the API Gateway endpoint.
  2. B
    Modify the backend Lambda integration function to catch authentication errors and return a structured JSON response containing the Access-Control-Allow-Origin header.
  3. Configure the 'Unauthorized' (401) Gateway Response in the API Gateway console to return the Access-Control-Allow-Origin header set to the origin domain.Cevap
  4. D
    Modify the Lambda Authorizer to return an IAM policy that explicitly grants the 'apigateway:OPTIONS' permission to the client's IAM role.
  5. Configure the 'Access Denied' (403) Gateway Response in the API Gateway console to return the Access-Control-Allow-Origin header set to the origin domain.Cevap

Cevap

Configure the 'Unauthorized' (401) and 'Access Denied' (403) Gateway Responses in API Gateway to include the 'Access-Control-Allow-Origin' header.
When a client-side application receives a CORS preflight error during authentication failure, it is because the API Gateway authorizer rejects the request before it reaches the backend integration. As a result, API Gateway generates a default Gateway Response (either 401 Unauthorized or 403 Access Denied) which does not contain CORS headers by default. Configuring the 'Unauthorized' and 'Access Denied' Gateway Responses to return the 'Access-Control-Allow-Origin' header ensures the browser receives the CORS headers and allows the client application to read the HTTP status code.

Adım Adım Çözüm

1
Identify the source of the error when session tokens expire.
The Lambda Authorizer either throws an error resulting in a 401 Unauthorized status, or returns a Deny policy resulting in a 403 Access Denied status.
Understanding where execution terminates helps determine why CORS headers are missing.
2
Determine how CORS headers are handled during gateway-level failures.
Because the execution is terminated at the authorizer level before reaching the backend integration, standard integration response headers are bypassed, and API Gateway returns a Gateway Response.
CORS headers must be attached to the Gateway Responses directly since the backend Lambda code is never executed.
3
Configure Gateway Responses in API Gateway.
Add the 'Access-Control-Allow-Origin' header to both the 'Unauthorized' (401) and 'Access Denied' (403) Gateway Responses.
This ensures the browser receives the required CORS headers for both failure modes, allowing the client-side code to read the HTTP status codes and display the session expiration message.

Anahtar Kavram

Configuring CORS on Gateway Responses for Custom Authorizer failures
Bu soruyu puanla

Konular

Troubleshooting API Gateway Errors and CORS

Bu konudan daha fazla soru