glassechidna / serverlessish Goto Github PK

I was having the following error in chrome:

Access to fetch at 'https://***.execute-api.eu-west-1.amazonaws.com/api.php' from origin 'https://***' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The 'Access-Control-Allow-Origin' header contains multiple values 'https://***, https://***', but only one is allowed. Have the server send the header with a valid value, or, if an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

after a curl -v on the execute-api endpoint, I can see the headers are indeed sent twice:

< HTTP/2 200
< date: Mon, 21 Dec 2020 19:14:38 GMT
< content-type: text/html; charset=UTF-8
< content-length: 0
< access-control-allow-origin: https://***
< access-control-allow-origin: https://***
< access-control-allow-headers: Content-Type
< access-control-allow-headers: Content-Type
< apigw-requestid: X6sUujpVjoEEM-Q=

those headers are sent by the application running behind serverlessish, but when running locally they are sent only once

after review the code in http.go#L51, I see the headers are set once in json:"headers" and once in json:"multiValueHeaders":

	output := &httpResponseOutput{
		StatusCode:        resp.StatusCode,
		StatusDescription: resp.Status,
		HeadersMV:         resp.Header,
		Headers:           headers,
		Body:              encoded,
		IsBase64Encoded:   true,
	}

According to the following article:
https://aws.amazon.com/blogs/compute/support-for-multi-value-parameters-in-amazon-api-gateway/

"You can also pass the header key along with the multiValueHeaders key. In that case, API Gateway merges the multiValueHeaders and headers maps while processing the integration response into a single Map<String, List> value. If the same key-value pair is sent in both, it isn’t duplicated."

I wonder where the issue might come from

Hey, this project looks super interesting! I'm certain I'm missing something here, but how does the /opt/extensions/serverlessish binary get invoked/bootstrapped? It looks like once the serverlessish executable is started, it polls the lambda runtime api for events (sent by APIG/ALB) and forwards/proxies them to the user's http server process. Just not seeing how it gets bootstrapped. It looks like the Dockerfile's entrypoint is the user's executable.