CODEWITHSUNDEEP
amazon-web-servicesaws-lambdaaws-api-gateway
StaticMethod
StaticMethod

Reputation: 837

set-cookie header Is removed by AWS HTTP API Gateway

I writing a serverless website using Amazon Web Services S3, Lambda, and the HTTP API Gateway, not the REST API Gateway. I am trying to set a cookie with one of my lambda functions and it works when I hit the lambda function directly using the lambda function url, but when I hit the url using the HTTP API Gateway, the Set-Cookie header is stripped off. The body, and all other custom headers are present, but the set-cookie header is just gone.

I've tried with and without the domain=***.com in the header and that doesn't make a difference.

I've tried messing with CORS and enabling Access-Control-Allow-Credentials. I've set Access-Control-Allow-Origin to the correct domain name. I've tried both set-cookie and * for Access-Control-Allow-Headers and Access-Control-Expose-Headers. Although I don't think CORS really matters because I'm using Postman and my understanding is it doesn't require CORS.

Does the HTTP API Gateway just not support setting cookies? It would be great if that was documented somewhere.

Upvotes: 3

Views: 1087

Answers (1)

StaticMethod
StaticMethod

Reputation: 837

I forgot that I was using CloudFront. By default CloudFront does not forward cookies to or from the origin, so I had to set the CloudFront caching policy to allow that. More information here: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Cookies.html

Upvotes: 1

Related Questions