4
votes

We're currently using a Serverless deployment model for our API, with a NodeJS express code base. All was well until we ran into a hard limit for the CloudFormation stacks created by serverless which have a created resource limit of 200.

Trying to work around this while the Serverless team is working on nested stack integration was to replace GET,PUT,POST,DELETE for a single route with ANY which saved us roughly 75% in CloudFormation resources.

API Gateway seemed to take it well, the integration response for the OPTIONS route returned Access-Control-Allow-Methods: 'OPTIONS,ANY'.

Testing this with postman worked like a charm, being able to use all previously mentioned methods without a hitch.

Exercising this from our Angular front-end doesn't seem to work though.

XMLHttpRequest cannot load . Method PUT is not allowed by Access-Control-Allow-Methods in preflight response.

In Angular's eyes, POST, PUT, DELETE, ... don't match up to ANY whereas for postman it does.

Any input why this might be occurring will be greatly appreciated.

UPDATE

A POST request works through the Angular application, just the PUT and DELETE requests throw the 'not allowed by Access-Control-Allow-Methods' error.

2

2 Answers

0
votes

The integration response for the OPTIONS route returned Access-Control-Allow-Methods: 'OPTIONS,ANY'.

If you are enabling CORS by creating OPTIONS resource via CloudFormation template, then you should make 'Access-Control-Allow-Methods' header to return 'DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT' instead of 'OPTIONS,ANY'. (This is how API Gateway console would do if you enable CORS from console). That should fix it.

0
votes

Updating Serverless to a version higher than 1.10.0 fixed it. They've fixed this bug in this issue.