aws-apigateway: Removal of wildcard matching from Allowed origins for CORS preflight was a breaking change
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
The ability to match origins using regular expressions was removed with this change:
https://github.com/aws/aws-cdk/issues/26623
This causes a breaking change for Core origins relying on that behaviour.
A use case is matching a prefix/wildcard origin, for example, `*.example.com` -> `/https:\/\/.+\.example\.com/`
### Expected Behavior
The ability to match wildcard origins.
e.g., `https://*.example.com`
https://github.com/aws/aws-cdk/blob/7264121edb10feca6d4c2bce359138deb62bdf79/packages/aws-cdk-lib/aws-apigateway/lib/resource.ts#L326C1-L326C76
### Current Behavior
Only `*` wildcard or exact origins are allowed.
This prevents prefix matching of origins.
### Reproduction Steps
```typescript
const api = new apigw.RestApi(stack, 'cors-api-test', {
defaultCorsPreflightOptions: {
allowOrigins: ['https://*.amazon.com', 'https://twitch.tv'],
},
});
```
Produces response template:
```
#set($origin = $input.params().header.get("Origin"))
#if($origin == "")
#set($origin = $input.params().header.get("origin"))
#end
#if($origin == "https://*.amazon.com") || $origin == "https://twitch.tv")
#set($context.responseOverride.header.Access-Control-Allow-Origin = $origin)
#end'
```
### Possible Solution
```typescript
const condition = origins.map(wildcardPrefixToRegex).map(regex => `$origin.matches("${regex}")`).join(' || ');
...
function wildcardPrefixToRegex(glob) {
// replace '.' with '\.'
// replace '*' with '.+'
}
```
Produces response template:
```
#set($origin = $input.params().header.get("Origin"))
#if($origin == "")
#set($origin = $input.params().header.get("origin"))
#end
#if($origin.matches("https://.+\.amazon\.com") || $origin.matches("https:\/\/twitch\.tv"))
#set($context.responseOverride.header.Access-Control-Allow-Origin = $origin)
#end'
```
### Additional Information/Context
_No response_
### CDK CLI Version
2.115.0 (build 58027ee)
### Framework Version
_No response_
### Node.js Version
v18.14.0.
### OS
n/a
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start in packages/aws-cdk-lib/aws-apigateway/lib/resource.ts at the linked CORS preflight generation and compare it with the reported reproduction. Confirm wildcard or prefix origins are matched without breaking exact-origin or * handling, then run the relevant aws-apigateway tests and verify the generated response template.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- api, cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100