Why I am getting cors error when my configuration are set pr

Question

Why I am getting cors error when my configuration are set properly in AWS lambda ``` app use cors origin https loquacious crostata a45e75 netlify app allowedHeaders content type supertokens getAllCORSHeaders credentials true ```

rp · Answer

hey can i see the cors error Also have you seen the debugging section docs It has a page about CORS errors

Ayush6543 · Answer

When I checked the headers inside the networks tab access control allow origin was the url

Ayush6543 · Answer

Access to fetch at https 0qa7uoar49 execute api eu central 1 amazonaws com dev auth signin from origin https loquacious crostata a45e75 netlify app has been blocked by CORS policy Request header field fdi version is not allowed by Access Control Allow Headers in preflight response

rp · Answer

hmm Can i see the response headers of the OPTIONS API call

Ayush6543 · Answer

access control allow credentials true access control allow headers Content Type X Amz Date Authorization X Api Key X Amz Security Token access control allow methods DELETE GET HEAD OPTIONS PATCH POST PUT access control allow origin https loquacious crostata a45e75 netlify app content length 0 content type application json date Tue 03 Jan 2023 13 09 48 GMT via 1 1 8848e817dbad32b1ae333eabdea228d4 cloudfront net CloudFront x amz apigw id eKtcbGbEFiAFRtg= x amz cf id goZknIkdSIYP7VSSXLBFDyJNeXrFVq72goq9bZCEK VerdSnajmzVg== x amz cf pop MAA51 P1 x amzn requestid ee9008f7 03d9 4dfc ba09 beb9b5e818ef x cache Miss from cloudfront

rp · Answer

Right So somehow the allowed headers list is getting overwritten somewhere to remove the stuff added by ` supertokens getAllCORSHeaders ` part of the code

rp · Answer

so that you will have to see whats overwriting it

Ayush6543 · Answer

Can lambda overwrite it

rp · Answer

Can be It s quite possible

rp · Answer

really depends on your infra

rp · Answer

even netlify might be

Ayush6543 · Answer

Is it necessary to add supertokens layer in lambda fucntion

rp · Answer

< KShivendu> can help here

KShivendu · Answer

> Is it necessary to add supertokens layer in lambda fucntion Not necessary It just needs the source code of the SDK Can be uploaded directly as well as via lambda layer

Ayush6543 · Answer

Hmm Yeah I am using express and supertokens node package so it should be enough Right

KShivendu · Answer

Assuming rest of the dependencies are also there it should work fine

KShivendu · Answer

You can actually check your logs as well

Ayush6543 · Answer

Yeah It was working fine before but now I am gettng this cors error when i redployed it

KShivendu · Answer

Try checking your logs while you make an API call

Ayush6543 · Answer

Now it s giving me 404 error but all the headers are there in the response

Ayush6543 · Answer

This is my intilisation ``` supertokens init framework express supertokens connectionURI `$ process env SUPERTOKENS CONNECT URL ` apiKey `$ process env SUPERTOKENS API KEY ` appInfo learn more about this on https supertokens com docs session appinfo appName Todo list apiDomain `$ process env API DOMAIN ` websiteDomain `$ process env WEBSITE DOMAIN ` apiBasePath dev auth recipeList UserMetadata init ThirdPartyEmailPassword init providers Google clientSecret process env GOOGLE CLIENT SECRET clientId process env GOOGLE CLIENT ID Session init initializes session features UserRoles init Dashboard init apiKey `$ process env DASHBOARD API KEY ` give a custom api key for domain EmailVerification init mode OPTIONAL isInServerlessEnv true ```

KShivendu · Answer

Also says Cannot POST auth signup

KShivendu · Answer

https x6dsgtj144 execute api eu central 1 amazonaws com dev auth signup email exists email=someone example com Should have worked

KShivendu · Answer

Can you see the logs when you call this

KShivendu · Answer

Let s get on a call to discuss this if it takes too long

Ayush6543 · Answer

It s a get request right

KShivendu · Answer

Hmm then this should fix your issue backend ```ts appInfo learn more about this on https supertokens com docs session appinfo appName Todo list apiDomain `$ process env API DOMAIN ` websiteDomain `$ process env WEBSITE DOMAIN ` apiBasePath auth note this apiGatewayPath dev note this ``` frontend ```js apiBasePath dev auth ```

KShivendu · Answer

< Ayush6543> let me know when you try this

KShivendu · Answer

< Ayush6543> are you gonna do this today

Ayush6543 · Answer

I am deploying it s taking time to upload

Ayush6543 · Answer

Yeah ur solution worked

Ayush6543 · Answer

But I have one question why the status code for preflight request are also 200 when it should be 204

Ayush6543 · Answer

Hey I have one cors issue coming up when I override the thirdparty config to deny emails that already exists Here is my supertokens thirdparty config

Ayush6543 · Answer

My error is ``` google 1 Access to fetch at https x6dsgtj144 execute api eu central 1 amazonaws com dev auth signinup from origin https loquacious crostata a45e75 netlify app has been blocked by CORS policy No Access Control Allow Origin header is present on the requested resource If an opaque response serves your needs set the request s mode to no cors to fetch the resource with CORS disabled ``` < KShivendu> < rp>

rp · Answer

does it work without the override what are the response headers in the OPTIONS API and in the actual POST API

Ayush6543 · Answer

Yeah it works without the override

rp · Answer

so you might want to check what the API is responding with It might be throwing an error which you don t catch

Ayush6543 · Answer

It gives a 502 error

rp · Answer

yea so please see why

rp · Answer

which part of your override fails

Ayush6543 · Answer

Hey when I check the dashboard the email is created

rp · Answer

are you using nginx in front of the API server

Ayush6543 · Answer

Nope aws lambda

rp · Answer

i think the issue might be the header size in the response

Ayush6543 · Answer

The same thing works like charm on my local development server Did you see the error it s cors error ``` Access to fetch at https x6dsgtj144 execute api eu central 1 amazonaws com dev auth signinup from origin https loquacious crostata a45e75 netlify app has been blocked by CORS policy No Access Control Allow Origin header is present on the requested resource If an opaque response serves your needs set the request s mode to no cors to fetch the resource with CORS disabled ```

rp · Answer

Yea I think there is some config somewhere which is restricting the size of the headers in the response This usually happens if nginx is being used but can also happen from AWS side Not sure