Request: Demonstrate how to configure and handle CORS

[kastork]

While smithy has some minimal coverage of CORS in the trait documentation, the ssdk generator docs don't . Do you have to handle OPTIONS yourself (this seems to be the case), or is there some magic in the generated code?

If you must wire up handling CORS preflights yourself, how/where should you do that?

[rpg2014]

IIRC the smithy cors option is implemented via API Gateway mock integrations within the OpenAPI definition. If you have a simpler CORS usecase, I would recommend this route. CORS would be handled via APIG, and you wouldn't require any code changes. However this only supports a single url or wildcard CORS. For my usecase I needed to support dynamic subdomains, so I extracted the logic out to a separate lambda function within the cdk-stack. I edited the OpenAPI definition before creating the SpecRestApi cdk construct, within this function here: https://github.com/aws-samples/smithy-server-generator-typescript-sample/blob/main/server/lib/cdk-stack.ts#L82-L112.

I've added the below code to the bottom of the for(const path in openapi.paths) loop:

// Add options integration to each path
openapi.paths[path]["options"] = {
        description: `Handles CORS-preflight requests`,
        operationId: `Cors${path
          .toString()
          .split("/")
          .map(s => s.charAt(0).toUpperCase() + s.slice(1))
          .join("")}`,
        responses: {
          "200": {
            description: "Canned headers for CORS-preflight requests",
            headers: {
              "Access-Control-Allow-Headers": {
                schema: {
                  type: "string",
                },
              },
              "Access-Control-Allow-Methods": {
                schema: {
                  type: "string",
                },
              },
              "Access-Control-Allow-Origin": {
                schema: {
                  type: "string",
                },
              },
              "Access-Control-Max-Age": {
                schema: {
                  type: "string",
                },
              },
            },
          },
        },
        security: [],
        tags: ["CORS"],
        "x-amazon-apigateway-integration": {
          type: "aws_proxy",
          httpMethod: "POST",
          uri: `arn:${this.partition}:apigateway:${this.region}:lambda:path/2015-03-31/functions/${this.corsFunction.functionArn}/invocations`,
        },
      };

This links the CORS lambda function to the options method of each Smithy operation. Unfortunately this CORS support isn't represented in the smithy model, only the CDK implementation, but it does let you fully customize the CORS logic.