# API Gateway HTTP API & CORS

**URL:** <https://forum.serverless.com/t/api-gateway-http-api-cors/12416>\
**Category:** Serverless Framework\
**Tags:** cors, api-gateway\
**Created:** [August 29, 2020, 7:19pm UTC](https://forum.serverless.com/t/api-gateway-http-api-cors/12416 "2020-08-29T19:19:15Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![muhwu](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@muhwu](https://forum.serverless.com/u/muhwu)\
**Post date:** [August 29, 2020, 7:19pm UTC](https://forum.serverless.com/t/api-gateway-http-api-cors/12416/1 "2020-08-29T19:19:16Z")

</div>

New in the forums here and relatively new to Serverless framework here so bear with me. I have a simple end-point that I deployed using the httpApi. I want to set up CORS for it and according to the reference here, it should be possible:

> **[Serverless Framework - AWS Lambda Guide - Serverless.yml Reference](https://www.serverless.com/framework/docs/providers/aws/guide/serverless.yml/)**
>
> The Serverless Framework documentation for AWS Lambda, API Gateway, EventBridge, DynamoDB and much more.

However, I get this in for my config:  
`Serverless: Configuration warning at 'functions.requestRegistration.events[1].httpApi': unrecognized property 'cors'`

This is more than mildly inconvenient - my serverless.yml looks like this for the relevant part:

```auto
  requestRegistration:
    handler: UserApi/requestRegistration.handler
    #reservedConcurrency: ${self:custom.lambdaConcurrency}
    events:
      - http:
          path: register
          method: post
          cors: true
      - httpApi:
          cors: true
          method: POST
          path: /register

```

And these are the versions I’m rocking:

> Framework Core: 1.80.0  
> Plugin: 3.8.1  
> SDK: 2.3.1  
> Components: 2.34.9

In addition, setting the “payload: ‘2.0’” for them also gives me an unrecognized property error. What am I missing here?

---

<div class="post-metadata">

**Author:** ![PierrickI3](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/pierricki3/32/5357_2.png) [@PierrickI3](https://forum.serverless.com/u/PierrickI3)\
**Post date:** [September 7, 2020, 1:51pm UTC](https://forum.serverless.com/t/api-gateway-http-api-cors/12416/2 "2020-09-07T13:51:47Z")

</div>

Having the same warning here, even after updating to the latest serverless. Have you found out what was happening on your side?

---

<div class="post-metadata">

**Author:** ![pete.ruuby](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/pete.ruuby/32/4427_2.png) [@pete.ruuby](https://forum.serverless.com/u/pete.ruuby)\
**Post date:** [September 22, 2020, 1:39pm UTC](https://forum.serverless.com/t/api-gateway-http-api-cors/12416/3 "2020-09-22T13:39:57Z")

</div>

It seems the cors configuration got moved up into the _provider_ config:

> **[Serverless Framework - AWS Lambda Events - HTTP API](https://www.serverless.com/framework/docs/providers/aws/events/http-api/)**
>
> Setting up API Gateway HTTP APIs with AWS Lambda via the Serverless Framework

---

<div class="post-metadata">

**Author:** ![muhwu](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@muhwu](https://forum.serverless.com/u/muhwu)\
**Post date:** [September 27, 2020, 2:03pm UTC](https://forum.serverless.com/t/api-gateway-http-api-cors/12416/4 "2020-09-27T14:03:28Z")

</div>

Oh I see, thanks! That clarifies it. I was able to hack around the thing by defining OPTIONS end-points myself that return 200 OK, but this seems preferable.

---

<div class="post-metadata">

**Author:** ![jonee](https://avatars.discourse-cdn.com/v4/letter/j/e8c25b/32.png) [@jonee](https://forum.serverless.com/u/jonee)\
**Post date:** [September 30, 2020, 4:14am UTC](https://forum.serverless.com/t/api-gateway-http-api-cors/12416/5 "2020-09-30T04:14:27Z")

</div>

Cors should work by default imho. No need to set anything in the serverless.yml.

---

<div class="post-metadata">

**Author:** ![elgubenis](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/elgubenis/32/6655_2.png) [@elgubenis](https://forum.serverless.com/u/elgubenis)\
**Post date:** [March 1, 2022, 9:46am UTC](https://forum.serverless.com/t/api-gateway-http-api-cors/12416/6 "2022-03-01T09:46:43Z")

</div>

That would be quite dangerous, cors exists so that not any remote origin can access your resources, it’s for your resources protection, so it’s ideal to not work by default, but having fine-grained controls to allow it step by step.