Skip to content

ensure apigatewayv2 cors configuration is not set when input is 'false'#6749

Open
Probotect0r wants to merge 1 commit intoanomalyco:devfrom
Probotect0r:fix/fix-empty-cors-configuration
Open

ensure apigatewayv2 cors configuration is not set when input is 'false'#6749
Probotect0r wants to merge 1 commit intoanomalyco:devfrom
Probotect0r:fix/fix-empty-cors-configuration

Conversation

@Probotect0r
Copy link
Copy Markdown
Contributor

@Probotect0r Probotect0r commented Apr 15, 2026

Fixes #6748

Background

Specifying cors: false on the ApiGatewayv2 construct results in the cors configuration being set to {} which actually sets a barebones default configuration instead of completely clearing it. The barebones default config results in all requests to the Api failing cors because the allowed origins and headers list is empty.

Notes

Because the corsConfiguration parameter on the pulumi api construct is Output<ApiArgs> | undefined, I had to wrap the whole creation of the apigateway inside a .apply().

I tested this code change by deploying it and verifying the cors config value using aws apigatewayv2 get-api --api-id <my id> --query "CorsConfiguration" --region us-east-2

@Probotect0r
Copy link
Copy Markdown
Contributor Author

@vimtor thoughts?


function normalizeCors() {
return output(args.cors).apply((cors) => {
if (cors === false) return {};
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wouldn't just returning undefined here do the trick?

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if you did this because typescript complains about pulumi, we can either do @ts-ignore or unwrap cors from Input in the type definition

i lean towards the latter

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Simply returning undefined doesn't work, because it needs to be returned from inside the .apply(), since the input argument type is Input<boolean | Apiv2args...>. But returning undefined from inside the apply() results in a return type of Output<Apiv2CorsConfiguration | undefined>, which is not assignable to Input<Apiv2CorsConfiguration> | undefined.

What are the consequences of changing the cors argument type to boolean | Prettify<ApiGatewayV2CorsArgs>? The individual fields on ApiGatewayV2CorsArgs are still Input, so I am guessing it's fine? Still allows someone to pass in an Input for the specific fields?

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it would break on the very very unlikely scenario that someone is passing an output to cors

we should do the // @ts-ignore instead to be safe

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

APIGatewayV2 construct doesn't actually clear the CORS config when cors: false is set

2 participants