[@aws-cdk/aws-s3] More than one CORS origin not applied correctly
See original GitHub issueThe allowedOrigins
property passed into an addCorsRule
call is not behaving as expected.
The following code:
const bucket = new Bucket(/*...*/);
bucket.addCorsRule({
allowedMethods: [HttpMethods.GET, HttpMethods.HEAD],
allowedOrigins: [`https://${domainName}`, `https://www.${domainName}`] // Note, two origins are passed in accordance to the docs.
});
Generates the following S3 config:
<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
<AllowedOrigin>https://baseline.dev</AllowedOrigin>
<AllowedOrigin>https://www.baseline.dev</AllowedOrigin>
<AllowedMethod>GET</AllowedMethod>
<AllowedMethod>HEAD</AllowedMethod>
</CORSRule>
</CORSConfiguration>
When requesting the object, only the first origin is passed in the header:
access-control-allow-origin: https://baseline.dev
According to the docs, there should one CORSRule per origin. So the CDK should generate two rules or only allow a string, not an array of origins.
Separating into two addCoresRule
calls fixes the underlying issue in the meantime.
Environment
- CLI Version : v1.62.0
- Framework Version: v1.62.0
This is 🐛 Bug Report
Issue Analytics
- State:
- Created 3 years ago
- Comments:11 (9 by maintainers)
Top Results From Across the Web
Reason: Multiple CORS header 'Access-Control-Allow-Origin ...
More than one Access-Control-Allow-Origin header was sent by the server. This isn't allowed.
Read more >Resolve the "No 'Access-Control-Allow-Origin' header" error ...
If CORS headers are not returned in the response, then the origin server is not correctly setup for CORS. Set up a CORS...
Read more >3 Ways to Fix the CORS Error — and How the Access-Control ...
Fix one: install the Allow-Control-Allow-Origin plugin. The quickest fix you can make is to install the moesif CORS extension .
Read more >Access-Control-Allow-Origin Multiple Origin Domains?
I have tried the above code but it does not seem to work in Firefox. Is it possible to specify multiple domains or...
Read more >The Access-Control-Allow-Origin Header Explained
Often times when calling an API, you may see an error in your console that ... Origin is not just the hostname, but...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
This might be an issue with the underlying CFN resource because the CDK simply mirrors it.
Marking in any case because it can be mitigated by CDK regardless.
⚠️COMMENT VISIBILITY WARNING⚠️
Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.