Chalice: Authorized routes with CORs

[MichaelBoselowitz]

First off, thank you for creating and maintaining this library! It has been a real joy to use.

The issue I'm having is there doesn't seem to be an easy way to create an unauthenticated CORs preflight route for an authenticated route, e.g. if you create a route with the following:

@app.route('/', authorizer=authorizer, cors=True)
def index():
    pass

You end up having an authenticated CORs preflight route—this doesn't seem like very good practice, or at least it's not very ergonomic when writing a frontend to talk to this API.

The only work around I've found to support unauthenticated preflight OPTIONS routes on authenticated routes is to create my own OPTIONS routes and respond to the preflight requests manually.

To make this a little more bearable, I created a utility function to automate this process a bit:

def create_cors_routes(app, route, methods=['GET']):
    def cors_route(*args, **kwargs):
        request = app.current_request
        headers = {
            'Access-Control-Allow-Method': ','.join(methods),
            'Access-Control-Allow-Origin': ','.join(ALLOWED_ORIGINS),
            'Access-Control-Allow-Headers': 'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token'
        }
        origin = request.headers.get('origin', '')
        if origin in ALLOWED_ORIGINS:
            headers.update({ 'Access-Control-Allow-Origin': origin })
        return Response(
            body=None,
            headers=headers
        )
    app.route(route, methods=['OPTIONS'])(cors_route)

Once the utility function is in place, it can be used like the following:

create_cors_routes(app, '/resource', methods=['GET', 'POST'])
create_cors_routes(
    app,
    '/resource/{id}',
    methods=['GET', 'PUT', 'PATCH', 'DELETE']
)

Is there a better way to do this / can the CORSConfig be extended to allow for unauthenticated preflight routes?

[MichaelBoselowitz]

The above example will work (to some extent), but when working with the API via the browser CORs headers must also be returned from all requests. Browsing through the Chalice codebase there doesn't seem to be an obvious way to be able to send CORs headers under all of the following conditions:

1. OPTIONS preflight requests—especially on otherwise authorized routes.
2. Returning CORs headers on regular route execution.
3. Returning CORs headers on authorization error (before it gets to the route) or other manually raised errors.

[stealthycoin]

Yep you are correct there is no support for that at the moment.

[tahayk]

any update about this please ?

[MichaelBoselowitz]

Unfortunately I did not come up with a good workaround for this. I had to abandon this approach altogether.

Luckily, my environment was flexible enough that I could quickly solve this by using the same CloudFront instance to serve the front end and the API—they’re under the same domain so no CORs issues. Not a very suitable workaround for most, but I couldn’t find a suitable in-framework workaround.

[Zuiluj]

Any updates on this?

[cwaldvonderlahr]

@MichaelBoselowitz Thanks for your issue description. I've the same issue at the moment. Do you use your workaround without an extra lambda auth function?

@stealthycoin Does the feature request still exist and is it realistic that it will be processed?

[ToddKingham]

Is there any update on this?

It seems more like a bug (or at least an oversight) than a feature request. I really want to use Chalice for its elegance and access to the AWS ecosystem, but I NEED the ability build endpoints that require authentication and allows CORS access.