CORS headers missing when request header has 'Accept-Encoding' for website of CloudFront + S3

Question

we have a s3 bucket that is configured for CORS access. It has a CloudFront instance sitting in front of it. Here is the odd behavior I observed:

URL & Request Header | CORS headers in response

CF + "Accept-Encoding" | No

S3 + Accept-Encoding | Yes

CF - 'Accept-Encoding' | Yes

Is it expected? How can I force CF to always return CORS headers in response? thank you for any hints/clues

Answer 1

I found that this issue appears when you set access-control-allow-origin: * in CloudFront > 'your distribution' > Origins > 'your origin' > Edit > Origin Custom Headers. To fix this issue I removed that Origin Custom Header, see the screenshot:

---

---

Also, you need to create an invalidation so changes take effect, CloudFront > 'your distribution' > Invalidations > Create Invalidation. To invalidate all resources you can just pass /* in the field or any other valid regexp for your use case