[TM-1273] Don't allow OPTIONS to leak through to the service.

wri · Oct 22, 2024 · 7d2b6f0 · 7d2b6f0
1 parent d4af4c2
commit 7d2b6f0
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/apps/api-gateway/lib/api-gateway-stack.ts b/apps/api-gateway/lib/api-gateway-stack.ts
@@ -85,7 +85,7 @@ export class ApiGatewayStack extends Stack {
           CorsHttpMethod.OPTIONS,
         ],
         allowOrigins: ["*"],
-        allowHeaders: ['authorization,content-type'],
+        allowHeaders: ['authorization', 'content-type'],
       },
     }
     if (!IS_DEV) {
@@ -154,15 +154,15 @@ export class ApiGatewayStack extends Stack {
 
     this.httpApi.addRoutes({
       path: path,
-      methods: [HttpMethod.ANY],
+      methods: [HttpMethod.GET, HttpMethod.DELETE, HttpMethod.POST, HttpMethod.PATCH, HttpMethod.PUT],
       integration: lambdaIntegration,
     })
   }
 
   private addHttpUrlProxy (name: string, sourcePath: string, targetUrl: string) {
     this.httpApi.addRoutes({
       path: sourcePath,
-      methods: [HttpMethod.ANY],
+      methods: [HttpMethod.GET, HttpMethod.DELETE, HttpMethod.POST, HttpMethod.PATCH, HttpMethod.PUT],
       integration: new HttpUrlIntegration(name, targetUrl),
     });
   }
@@ -190,7 +190,7 @@ export class ApiGatewayStack extends Stack {
 
     this.httpApi.addRoutes({
       path: sourcePath,
-      methods: [HttpMethod.ANY],
+      methods: [HttpMethod.GET, HttpMethod.DELETE, HttpMethod.POST, HttpMethod.PATCH, HttpMethod.PUT],
       integration: new HttpAlbIntegration(name, serviceListener, { vpcLink: this._vpcLink })
     })
   }