Terraform部署的AWS API Gateway V2未返回CORS头问题求助

一、同域判断与预检请求的必要性 #

首先明确：你的Web应用部署在https://something.example.com，请求的目标URL是https://example.com/mypath，这属于跨域请求（主域example.com与子域something.example.com被浏览器判定为不同源）。同时，你的请求添加了自定义Token头，属于非简单请求，根据CORS规则，这类请求必然触发OPTIONS预检，无法跳过。

二、正确配置API Gateway V2响应预检请求 #

你的Terraform配置已包含基础CORS设置，但需补充完整路由与集成配置，并优化细节：

1. 补充路由与集成配置 #

仅定义aws_apigatewayv2_api无法完成请求转发，需添加集成与路由指向目标API：

# 配置集成到目标外部API
resource "aws_apigatewayv2_integration" "external_api_dev_integration" {
  api_id           = aws_apigatewayv2_api.external_api_dev.id
  integration_type = "HTTP_PROXY"
  integration_uri  = "https://somethingElse.example.com"
  integration_method = "ANY"
}

# 配置路由匹配目标路径
resource "aws_apigatewayv2_route" "external_api_dev_route" {
  api_id    = aws_apigatewayv2_api.external_api_dev.id
  route_key = "GET /mypath"
  target    = "integrations/${aws_apigatewayv2_integration.external_api_dev_integration.id}"
}

# 部署API到阶段
resource "aws_apigatewayv2_deployment" "external_api_dev_deployment" {
  api_id      = aws_apigatewayv2_api.external_api_dev.id
  triggers = {
    redeployment = sha1(jsonencode([
      aws_apigatewayv2_api.external_api_dev,
      aws_apigatewayv2_integration.external_api_dev_integration,
      aws_apigatewayv2_route.external_api_dev_route
    ]))
  }

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_apigatewayv2_stage" "external_api_dev_stage" {
  api_id         = aws_apigatewayv2_api.external_api_dev.id
  name           = "dev"
  deployment_id  = aws_apigatewayv2_deployment.external_api_dev_deployment.id
}

2. 优化CORS配置细节 #

• 移除allow_headers中的伪头（如:authority、:method），浏览器不会在预检中检查这些；
• 限制allow_origins为具体域名（而非*）提升安全性：

cors_configuration {
  allow_origins = ["https://something.example.com"]
  allow_methods = ["GET", "OPTIONS"]
  allow_headers = ["token", "content-type", "authorization"]
  max_age = 300
}

三、解决404与缺失Access-Control-Allow-Origin头问题 #

1. 修复404错误 #

404说明API Gateway路由与集成路径不匹配：

• 确保route_key与目标API的路径完全对应（比如目标API路径是/mypath?id=xxx，则路由设为GET /mypath）；
• 确认integration_uri指向目标API的完整基础域名（如https://somethingElse.example.com）。

2. 强制API Gateway返回CORS头 #

即使后端API未返回Access-Control-Allow-Origin，可通过API Gateway的响应头映射强制添加：

resource "aws_apigatewayv2_integration" "external_api_dev_integration" {
  # 其他现有配置...
  response_parameters = {
    "header.Access-Control-Allow-Origin" = "'https://something.example.com'"
    "header.Access-Control-Allow-Headers" = "'token,content-type'"
  }
}

内容的提问来源于stack exchange，提问作者Michael