aws / aws/aws-cdk

aws-apigateway: Removal of wildcard matching from Allowed origins for CORS preflight was a breaking change

Open
#28,445 2 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-apigateway bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

The ability to match origins using regular expressions was removed with this change:

https://github.com/aws/aws-cdk/issues/26623

This causes a breaking change for Core origins relying on that behaviour.

A use case is matching a prefix/wildcard origin, for example, `*.example.com` -> `/https:\/\/.+\.example\.com/`

### Expected Behavior

The ability to match wildcard origins.

e.g., `https://*.example.com`

https://github.com/aws/aws-cdk/blob/7264121edb10feca6d4c2bce359138deb62bdf79/packages/aws-cdk-lib/aws-apigateway/lib/resource.ts#L326C1-L326C76

### Current Behavior

Only `*` wildcard or exact origins are allowed.

This prevents prefix matching of origins.

### Reproduction Steps

```typescript
const api = new apigw.RestApi(stack, 'cors-api-test', {
defaultCorsPreflightOptions: {
allowOrigins: ['https://*.amazon.com', 'https://twitch.tv'],
},
});
```

Produces response template:

```
#set($origin = $input.params().header.get("Origin"))
#if($origin == "")
#set($origin = $input.params().header.get("origin"))
#end
#if($origin == "https://*.amazon.com") || $origin == "https://twitch.tv")
#set($context.responseOverride.header.Access-Control-Allow-Origin = $origin)
#end'
```

### Possible Solution

```typescript
const condition = origins.map(wildcardPrefixToRegex).map(regex => `$origin.matches("${regex}")`).join(' || ');

...
function wildcardPrefixToRegex(glob) {
// replace '.' with '\.'
// replace '*' with '.+'
}
```

Produces response template:
```
#set($origin = $input.params().header.get("Origin"))
#if($origin == "")
#set($origin = $input.params().header.get("origin"))
#end
#if($origin.matches("https://.+\.amazon\.com") || $origin.matches("https:\/\/twitch\.tv"))
#set($context.responseOverride.header.Access-Control-Allow-Origin = $origin)
#end'
```

### Additional Information/Context

_No response_

### CDK CLI Version

2.115.0 (build 58027ee)

### Framework Version

_No response_

### Node.js Version

v18.14.0.

### OS

n/a

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in packages/aws-cdk-lib/aws-apigateway/lib/resource.ts at the linked CORS preflight generation and compare it with the reported reproduction. Confirm wildcard or prefix origins are matched without breaking exact-origin or * handling, then run the relevant aws-apigateway tests and verify the generated response template.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
api, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.