title: What Access-Control-* headers to send back in response to CORS preflight OPTIONS request and then subsequent GET/POST/etc. request?
body: <p>I'm setting up a custom authorization workflow on API Gateway and looking for insights on CORS.</p>
  
  <p>I have an authorizer that returns an IAM role based on validation of a barertoken - that then invokes the lambda my target endpoint which returns the response as desired.</p>
  
  <p>I've made this work by adding my barer token to both the <code>OPTIONS</code> method and the <code>GET</code>/<code>POST</code> methods.</p>
  
  <p>In general, I'm adding most CORS headers to the <code>OPTIONS</code> + <code>GET</code>/<code>POST</code>/<code>etc</code> methods, but this seems superfluous.</p>
  
  <p>I'm a little outside of my depth here, but intuitively - if I needed to add the exact same headers in my <code>OPTIONS</code> method and the target method I think AWS would simply aggregate the headers from the target methods into the preflight options config, so I assume I'm adding the headers unnecessarily somewhere, but I'm not sure.</p>
  
  <p>Could someone please provide an overview / walk-through of how headers are being passed by API Gateway on a CORS api call?</p>
  
  <p>example info:</p>
  
  <pre><code>endpoint: api.example.com/logout
  methods: OPTIONS, GET
  </code></pre>
  
  <p>Currently I have:
  <code>OPTIONS</code>/<code>GET</code>:</p>
  
  <pre><code>request headers:
   &gt; barerToken
  response headers: 
   &gt; set-Cookie: integration.response.body.payload.httpCookie
   &gt; Access-Control-Allow-Headers: 'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,barerToken'
   &gt; Access-Control-Allow-Origin: 'https://example.com'
   &gt; Access-Control-Allow-Credentials: 'true'
   &gt; set-cookie: integration.response.body.payload.cookie
   &gt; Access-Control-Allow-Methods: 'OPTIONS,POST'
  </code></pre>
  
  <p>My intuition says I should only need the following:<br/>
  <code>OPTIONS</code>:</p>
  
  <pre><code>request headers:
   &gt; barerToken
  response headers:
   &gt; Access-Control-Allow-Headers: 'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token,barerToken'
   &gt; Access-Control-Allow-Origin: 'https://example.com'
   &gt; Access-Control-Allow-Credentials: 'true'
   &gt; Access-Control-Allow-Methods: 'OPTIONS,POST'
  </code></pre>
  
  <p><code>GET</code>:</p>
  
  <pre><code>response headers: 
   &gt; set-Cookie: integration.response.body.payload.httpCookie
   &gt; set-cookie: integration.response.body.payload.cookie
  </code></pre>
  
  <p>My understanding is that the flow is as follows:<br/>
  <code>Browser (Preflight) -&gt; End Point (OPTIONS) -&gt;  Browser (Request) -&gt; Authorizer Lambda -&gt; End Point (GET) -&gt; Browser (Response)</code></p>
  
  <p>OR<br/></p>
  
  <p><code>Browser (Preflight) -&gt;  Authorizer Lambda -&gt; End Point (OPTIONS) -&gt;  Browser (Request) -&gt; End Point (GET) -&gt; Browser (Response)</code></p>
  
  <p>But I could easily be mistaken.</p>
  
  <p>Lastly, should I only apply the authorizer to the <code>OPTIONS</code> method or should it be applied to the <code>OPTIONS</code> and <code>GET</code> methods? What are the advantages/disadvantages of one versus both?</p>