I'm running a Floci instance with Docker Compose and deploying a REST API Gateway, Lambda function, DynamoDB table, and Cognito resources through Terraform. The API works from Postman, but browser requests fail during the CORS preflight with: "Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource." I've set DISABLE_CORS_CHECKS=1 and tried configuring explicit OPTIONS methods for both the root path and a greedy {proxy+} path, with those methods proxying to the Lambda. The problem persists, so I'm unsure whether Floci is returning the OPTIONS response correctly or whether the Lambda/API configuration is missing something. What should I check or change?
2 Answers
The emulator is another possible source of the problem. Floci is only emulating AWS services, so behavior around API Gateway CORS or MOCK integrations may differ from real AWS. Test the preflight directly with curl and inspect the response headers, for example by sending an OPTIONS request with `Origin`, `Access-Control-Request-Method`, and `Access-Control-Request-Headers`. If those headers are missing, fix the Lambda or put a separate proxy in front of the emulator that adds them. Setting DISABLE_CORS_CHECKS generally does not make the browser accept a response; it only affects emulator-side checks.
Postman doesn’t enforce browser CORS rules, so a successful Postman request only proves that the API itself responds. The browser needs CORS headers on the preflight response and usually on the actual response too. Make sure the Lambda response for OPTIONS includes something like `Access-Control-Allow-Origin` set to the exact frontend origin, `Access-Control-Allow-Methods` containing the requested method, and `Access-Control-Allow-Headers` containing the headers sent by the browser. If credentials or cookies are used, the origin cannot be `*`; it must be explicit, along with `Access-Control-Allow-Credentials: true`. Also verify that the deployed stage is using the latest API Gateway deployment, not just the updated Terraform resources.
I added explicit OPTIONS methods that proxy to the Lambda, but I still get the same error. That suggests the important part may be the Lambda’s OPTIONS response itself rather than merely creating the method.
Using `*` can help prove that the issue is CORS policy, but it won’t work when the request includes credentials. In that case, return the specific frontend origin instead.