# Access-Control-Allow-Methods collects methods from multiple paths

**URL:** <https://forum.serverless.com/t/access-control-allow-methods-collects-methods-from-multiple-paths/4368>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [April 27, 2018, 2:03pm UTC](https://forum.serverless.com/t/access-control-allow-methods-collects-methods-from-multiple-paths/4368 "2018-04-27T14:03:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Typhlosaurus](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/typhlosaurus/32/1908_2.png) [@Typhlosaurus](https://forum.serverless.com/u/Typhlosaurus)\
**Post date:** [April 27, 2018, 2:03pm UTC](https://forum.serverless.com/t/access-control-allow-methods-collects-methods-from-multiple-paths/4368/1 "2018-04-27T14:03:13Z")

</div>

We are experiencing issues with the `Access-Control-Allow-Methods` header when I enable CORS for lambdas exposed via API Gateway.

First, we have multiple lambdas exposed via the API Gateway, each with it’s own path and varying HTTP verbs. The response to `OPTIONS` requests for later paths include not only `OPTIONS` and the verbs specified for the current path, but also any verbs enabled for previous paths within `serverless.yaml`!

```auto
functions:
    funcA:
        handler: a
        events:
         - http:
            path: path-a
            method: GET
            cors:
              header: ${self:custom.corsHeaders}
    funcB:
        handler: b
        events:
         - http:
            path: path-b
            method: POST
            cors:
              header: ${self:custom.corsHeaders}

```

If I send `OPTIONS` to `path-a` I’ll get `Access-Control-Allow-Methods: OPTIONS, GET` but if I send it to `path-b` I get `Access-Control-Allow-Methods: OPTIONS, GET, POST`

Workaround: explicitly set `cors.methods` for each event.

(We’ve experienced several issues with cors responses, I can’t remember whether this one occurred when `cors` was set to `true` as well as when `cors` was defined as an object).

---

<div class="post-metadata">

**Author:** ![bill](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bill/32/1072_2.png) [@bill](https://forum.serverless.com/u/bill)\
**Post date:** [April 29, 2018, 11:54am UTC](https://forum.serverless.com/t/access-control-allow-methods-collects-methods-from-multiple-paths/4368/2 "2018-04-29T11:54:28Z")

</div>

How about to define the methods directly in part of cors?

```
functions:
    funcA:
        handler: a
        events:
         - http:
            path: path-a
            method: GET
            cors:
              origins: "*"
              header: ${self:custom.corsHeaders}
              methods:
                  - GET
                  - OPTIONS
    funcB:
        handler: b
        events:
         - http:
            path: path-b
            method: POST
            cors:
              origins: "*"
              header: ${self:custom.corsHeaders}
              methods:
                  - POST
                  - OPTIONS
```