How to allow API Gateway Proxy Integration with Cognito Authorizer for POST requests?

Question

I'm trying to authorize API Gateway requests for a Lambda Proxy Integration resource using a Cognito User pool.

From the client, all requests work fine without an Authorizer. When I add an Authorizer, GET requests work when authorized, but a POST/PUT/DELETE request gives me this error:

401 Access to XMLHttpRequest at [Endpoint] from origin [client] has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource

I have selected 'Enable CORS' for the resource but it still won't work.

js request:

const jwt = this.$store.state.user
        .getSignInUserSession()
        .getIdToken()
        .getJwtToken();

const config = {
        headers: {
          authorization: jwt,
        },
        id: generatedID,
        name: 'generatedName',
      };

      axios.post(endpoint, config)
        .then((val) => { this.info = val; })
        .catch(err => console.log(err));

auth config: authorizer config

If I change request type from POST to GET, it works. If I remove the Authorizer from API Gateway, it works. What am I missing for POST/PUT/etc?

I want to get a 200/201 response and for the request to pass API Gateway authorization.

For Lambda Proxy Integration, you would need to manually add CORS headers in the Lambda response. Kindly refer to this documentation. — Arka Mukherjee
@lightyagami The lambda function already does that, but logs indicate that the lambda function isn't even being hit. Only the API shows any activity in cloudwatch, and it indicates only that the request is 'unauthorized' and stops there. — Matingcall

Robin Varghese Robin Varghese · Accepted Answer · 2019-11-05T12:23:00

This issue can be fixed by adding preflight 'OPTIONS' to the API Gateway as explained in this documentation.

After adding the preflight entry, api gateway should look like the screenshot.

https://enable-cors.org/server_awsapigateway.html

How to allow API Gateway Proxy Integration with Cognito Authorizer for POST requests?

2 Answers