Examkin

Soru

Zorluk: ZorTroubleshooting API Gateway Errors and CORS

A CORS preflight block error is displayed in the browser console when a client-side application hosted on https://webapp.example.com sends a request to an Amazon API Gateway REST API. The API is configured with a custom Lambda Authorizer. Investigation reveals that the error occurs only when the authorizer rejects requests containing expired JSON Web Tokens (JWTs), which prevents the browser from reading the actual 401 Unauthorized status code. How should the developer resolve this issue?

  1. A
    Modify the custom Lambda Authorizer function to return the Access-Control-Allow-Origin header within the validation context output.
  2. Configure Gateway Responses in API Gateway for the Unauthorized and Access Denied response types to return the required Access-Control-Allow-Origin header.Cevap
  3. C
    Configure the S3 bucket policy hosting the frontend application to allow CORS headers from the API Gateway endpoint.
  4. D
    Change the integration type of the API Gateway method to Lambda Custom integration and handle the HTTP headers directly.

Cevap

Configure Gateway Responses in API Gateway for the Unauthorized and Access Denied response types to return the required Access-Control-Allow-Origin header.
Configuring Gateway Responses in API Gateway for the Unauthorized and Access Denied response types ensures that when a request fails authentication at the custom authorizer level, the response returned by API Gateway contains the necessary Access-Control-Allow-Origin headers. This allows the browser to process the 401 or 403 HTTP status code instead of blocking the response due to CORS policy violations.

Adım Adım Çözüm

1
Analyze where the failure occurs in the API Gateway execution flow.
Since the token is expired, the custom Lambda Authorizer denies the request before API Gateway invokes the backend integration.
Understanding the request flow is essential to determine whether the error originates from the backend integration or API Gateway itself.
2
Determine the source of the generated HTTP error response.
API Gateway returns a gateway-generated response (such as 401 Unauthorized or 403 Forbidden).
When an authorizer rejects a request, API Gateway short-circuits the flow and handles the response directly.
3
Identify why the browser reports a CORS error on the authentication failure.
By default, Gateway Responses generated by API Gateway do not contain CORS headers (Access-Control-Allow-Origin).
A browser will reject any cross-origin response that lacks valid Access-Control-Allow-Origin headers, even if the backend integration is configured for CORS.
4
Configure the Gateway Responses in the API Gateway console or CloudFormation template.
The Access-Control-Allow-Origin header is added to the Unauthorized and Access Denied Gateway Responses, allowing the browser to read the actual HTTP response code.
This exposes the real status code (401/403) to the frontend client, allowing correct authentication error handling.

Anahtar Kavram

API Gateway Gateway Responses are used to customize responses and inject CORS headers for requests that fail before reaching the backend integration.
Bu soruyu puanla

Konular

Troubleshooting API Gateway Errors and CORS

Bu konudan daha fazla soru