I'm using the new API Gateway HTTP to make requests to 3rd party APIs. This works great for GET requests but doesn't work for POST requests due to CORS preflight.
When I try to make a request this is the error I get on the chrome console...
From the docs it says to add Access-Control-Allow-Methods to * and Access-Control-Allow-Origin to * but POST requests triggers a pre flight request and this is failing.
Any help appreciated!
Double-check your Access-Control-Allow-Headers. If it's missing any headers that are sent on the request it will silently fail.
I had the same issue (works for GET but not POST) because I had forgotten to add the content-type header to the list. This is a common header sent with POST requests and I can see it is missing in your example.
It may also help to examine the failed network requests in the browser console to see which headers are being sent.
Related
I have built an AWS API Gateway Rest API integration with AWS SNS.
(Setup in simplified form)
Post Requests --> RestAPI in AWS API Gateway -->SNS
I want to configure the Gateway to respond to the post request with one field I get from PostRequestsBody.
But in the docs that I have read, I am able to send just the response body of the SNS request.
1>Is it possible to respond with body PostRequest as a response body in Gateway?
2> if yes please direct me to the docs or please explain how it can be achieved.
I have gone through http://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-mapping-template-reference.html
which had explained just how to respond with details of integrated service(SNS in this case) response.
Even though this question is old now, it appears in search results.
AWS doesn't directly have a way to do this, but people have found hacks such as https://stackoverflow.com/a/61482410/563812
The short story: If I hit my endpoint /api/something with a PUT and no body, it goes through to my Lambda (via CF -> API GW -> Lambda). If I add a body to the request, it doesn't work and seems to die before hitting the API Gateway. I'm not sure why it would do this.
The long story:
I've set up a CloudFront distribution that sends requests to /api to our API gateway and all other requests just vend static website resources.
It has been working great so far for our simple use cases. We previously only hit the API Gateway with GET requests, but now we're going to start needing to send PUT or POST requests to the API Gateway. I had to update the CloudFront distribution "behaviors" for the /api path pattern (the one going to the API gateway) to allow all HTTP methods after that, I was able to start getting responses from the API Gateway for PUT and POST responses (previously only worked for GET).
However, I noticed that if I try to send a payload or body with the request (regardless of the request type), I don't think it actually hits the API Gateway or the Lambda that the API Gateway is routing to because I get a response of "You need to enable JavaScript to run this app". I tried looking at the logs but couldn't find anything. The heads shows "Error from cloudfront" but I'm not sure why or where to find what the error was.
Any tips on how to troubleshoot this or what the issue might be?
Update (10/8): I figured out the "enable javascript" thing was coming up because of my custom error pages for 403&404 errors. I deleted them in my development environment and now get a clearer error.
"This distribution is not configured to allow the HTTP request method
that was used for this request. The distribution supports only
cachable requests. We can't connect to the server for this app or
website at this time. There might be too much traffic or a
configuration error. Try again later, or contact the app or website
owner."
However, I still don't know what to do, as the request type (PUT) is enabled and the request works as long as I don't provide a body. Not sure how to get it to be ok with a body at the moment.
I am trying to add restricted header(expect-100-continue) to postman post request since I have a huge payload. I did some research and found out that postman ignores restricted headers like(expect) even if you add it to header section.
So I downloaded postman interceptor extension as I read in documentation we can add restricted headers through interceptor, I was able to connect interceptor to postman following documentation but I couldn't find a way to add that header.
How would we add those restricted headers to postman to test?
Note: I just want to let you know backstory of this problem too. we deployed our rest application to azure app services with client certificate enabled. when we hit it with large payload, server is not responding, found out from Microsoft documentation that we have to set expect: 100-continue header if we are sending large payload. just want to test adding the header through postman and see if it works. Below is the link of Microsoft documentation
https://learn.microsoft.com/en-us/archive/blogs/waws/posting-a-large-file-can-fail-if-you-enable-client-certificates
I have an api gateway installed that I'm trying to program against. Requests work when using apps like Postman but when I try to connect through code in the form of XMLHTTPRequests I get 401... No 'Access-Control-Allow-Origin' header is present on the requested resource. saying that the server doesn't allow cross site calls.
Maybe I'm not fully understanding how this works but it seems that apps like Postman circumvent this somehow. Whereas when I'm trying to access the api from a local file in my browser I bump into this problem.
Do I need to host the webpage I'm calling from to get this to work? Or am I missing something else here?
When the browser issues a XMLHTTPRequest, it checks if the origin (i.e. the domain) of that request is allowed by the endpoint to send requests. The check is done by a preflight request, i.e. a HTTP OPTIONS request which should provide a response containing a Access-Control-Allow-Origin header with the domain originating the request (or * to allow all domains).
Since this is a security measure of the browser, mainly based on the fact that browsing web pages the user may not know which requests are sent to which endpoints, Postman simply does not need to apply it because its requests are explicitly sent by the user himself.
https://developer.mozilla.org/en-US/docs/Glossary/CORS
https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
I have a question regarding the Tuleap REST API when used with CORS.
Basically, I'm trying to make a REST call to see the backlog of my project.
Referring to the API Explorer, to do so I need to do a GET call like this: /api/projects/{id}/backlog I also need to add the custom headers X-Auth-Token and X-Auth-UserId to ensure the authentication.
When I do this request with a HTTP Request tool (Poster for Firefox) everything works fine and I get status 200.
The problem now is that I'm trying to develop an application (in angularJS) that would do the same request.
I noticed that when the page is doing the request, it starts by doing a preflight OPTIONS request which is due to the Cross-Origin-Ressource-Sharing.
It seems like the X-Auth-Token and X-Auth-UserId header are being put in the Access-Control-Request-Headers. Because of that I get an unauthorized 401 response code from the server and I can't complete the request.
I've been looking online and couldn't find my answer as how to make this call work.
There was a recent contribution that should remove the need for authentication on all OPTIONS routes in order to enable the preflight: http://gerrit.tuleap.net/#/c/2642/ It was
Integrated in Tuleap 7.2.99.36
Either your version of Tuleap is too old or there is a bug.
Note all calls still require some headers such as "Content-Type: application/json"; the integration tests should provide good examples of how to make calls:
https://tuleap.net/plugins/git/tuleap/tuleap/stable?p=tuleap%2Fstable.git&a=tree&h=9a513f2b7e765f7b9a4f7f72e9d43f40f623fec5&hb=293d47e4006531d3c0d04edfc6e7058e53c7c9c8&f=tests/rest
and
https://tuleap.net/plugins/git/tuleap/tuleap/stable?p=tuleap%2Fstable.git&a=tree&h=4d9071865a42cbd0d40f5f933b4b0b1047c54a8c&hb=293d47e4006531d3c0d04edfc6e7058e53c7c9c8&f=tests/lib/rest