JWT Authorizers and CORS: why does the OPTIONS /{proxy+} need an integration attached?

Question

I am setting up a SPA with Cloudfront/API Gateway/Cognito JWT Auth/Lambda. I ran into the common issue with CORS pre-flight failing because of my authorizer in API Gateway. [Here is the AWS documentation on how to deal with this.](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-cors.html#http-api-cors-default-route).

I followed these instructions and the client now successfully passes CORS.

# Problem

My issue/question is with the `/{proxy+} ` route. When creating this route, I was required to attach an integration. I attached one and then detached it. When I detach this lambda integration, the Lambda UI (for this proxy route) shows a red warning/error:

`The API with ID tjrd1dqh6f doesn’t include a route with path /{proxy+} having an integration arn:aws:lambda:us-east-1:339712767340:function:GetStartedLambdaProxyIntegration.`

![Screenshot of warning](/media/postImages/original/IMXNsIi7e0R4Cf6f7zKYKUvQ)

# Question
What is the correct/expected solution here? Am I expected to have a "dummy" lambda integration for this CORS  work-around route? Do I just delete the lambda trigger? That seems to work, but I just want to know the expected setup.

Answer

Hi,

While using ```/{proxy+}``` greedy path with Method as ```ANY```, API gateway will forward all the requests including OPTIONS method request to the attached intergration. Now, if this route has authentication enabled, OPTIONS method will fail since that is added by browser, it may not pass correct authentication credentials. Hence to avoid such failures, it is recommended to create a dedicated method ```OPTIONS``` along with ```ANY``` method. This new method will handle all CORS pre-flight requests and you can disable Authentication on this method.

Now, for HTTP API, since there is no MOCK integration, you might required to integrate the same with Lambda/any other integration so that it can return the correct CORS headers.

> Am I expected to have a "dummy" lambda integration for this CORS work-around route?

yes, it is recommended to have lambda integration so that in future, if you wish to update your CORS headers, you can do so by updating lambda code

I guess this explains your question.

JWT Authorizers and CORS: why does the OPTIONS /{proxy+} need an integration attached?

Problem

Question

Relevant content