How to allow API Gateway Proxy Integration with Cognito Authorizer for POST requests?

Question

I'm trying to authorize API Gateway requests for a Lambda Proxy Integration resource using a Cognito User pool.

From the client, all requests work fine without an Authorizer. When I add an Authorizer, GET requests work when authorized, but a POST/PUT/DELETE request gives me this error:

401 Access to XMLHttpRequest at [Endpoint] from origin [client] has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource

I have selected 'Enable CORS' for the resource but it still won't work.

js request:

const jwt = this.$store.state.user
        .getSignInUserSession()
        .getIdToken()
        .getJwtToken();

const config = {
        headers: {
          authorization: jwt,
        },
        id: generatedID,
        name: 'generatedName',
      };

      axios.post(endpoint, config)
        .then((val) => { this.info = val; })
        .catch(err => console.log(err));

auth config: authorizer config

If I change request type from POST to GET, it works. If I remove the Authorizer from API Gateway, it works. What am I missing for POST/PUT/etc?

I want to get a 200/201 response and for the request to pass API Gateway authorization.

For Lambda Proxy Integration, you would need to manually add CORS headers in the Lambda response. Kindly refer to this documentation. — Arka Mukherjee
– Arka Mukherjee, Commented Apr 18, 2019 at 21:54
@lightyagami The lambda function already does that, but logs indicate that the lambda function isn't even being hit. Only the API shows any activity in cloudwatch, and it indicates only that the request is 'unauthorized' and stops there. — Matingcall
– Matingcall, Commented Apr 18, 2019 at 23:21

Robin Varghese · Accepted Answer · 2019-11-05 12:29:03Z

0

This issue can be fixed by adding preflight 'OPTIONS' to the API Gateway as explained in this documentation.

After adding the preflight entry, api gateway should look like the screenshot.

https://enable-cors.org/server_awsapigateway.html

edited Nov 5, 2019 at 12:29

answered Nov 5, 2019 at 12:23

Robin Varghese

1,1891 gold badge11 silver badges24 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Rub · Accepted Answer · 2021-03-04 22:36:55Z

If I change request type from POST to GET, it works.

That may be because when you do that it becomes a 'simple request' and it won't do a pre-flight OPTIONS request which fails in your case because of the Authorizer.

If I remove the Authorizer from API Gateway, it works. What am I missing for POST/PUT/etc?

The OPTIONS request fails to pass the Authorizer control, if you remove the Authorizer it works.

The full solution to your issue can be found here

Vue & Axios + AWS API Gateway & Lambda - CORS + POST not working

Summarizing. If you have a

route       verb            Authentication      integration
/private    POST/GET        yes                 lambda-private

Then you need to create an extra

route       verb            Authentication      integration
/private    POST/GET        yes                 lambda-private
/private    OPTIONS         no                  lambda-CORS-response

So your pre-flight request will get a nice response and the POST/GET request will hit your desired destination.

Collectives™ on Stack Overflow

How to allow API Gateway Proxy Integration with Cognito Authorizer for POST requests?

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related