# Application Load Balancer CORS **URL:** \ **Category:** Serverless Framework\ **Tags:** cors\ **Created:** [February 13, 2020, 3:45pm UTC](https://forum.serverless.com/t/application-load-balancer-cors/10550 "2020-02-13T15:45:26Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Khazuar](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/khazuar/32/3982_2.png) [@Khazuar](https://forum.serverless.com/u/Khazuar)\ **Post date:** [February 13, 2020, 3:45pm UTC](https://forum.serverless.com/t/application-load-balancer-cors/10550/1 "2020-02-13T15:45:26Z")
Hi, we’re using an AWS ALB (application load balancer) to orchestrate access to some preexisting services of ours which are running in AWS ESC containers. I now wanted to add a serverless node.js application for a few new endpoints and just “hook” it into the ALB. That works fine when I access the api via postman, but if I try accessing this new endpoint from the frontend I get CORS issues. All the help-articles I found so far are about how to enable CORS with the AWS ApiGateway, using serverless with an ALB already seems like quite an exotic setup and I find just little information on it in general ☹ . If I try to set the CORS headers in the serverless handlers, the ALB will respond with a 502 BAD GATEWAY response, indicating it didn’t like what the lambda returned. The ALB also doesn’t seem to support the “cors: true”-setting for the yml-files. Am I doing anything wrong here? ---
**Author:** ![shadrech](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/shadrech/32/3951_2.png) [@shadrech](https://forum.serverless.com/u/shadrech)\ **Post date:** [February 18, 2020, 12:32am UTC](https://forum.serverless.com/t/application-load-balancer-cors/10550/2 "2020-02-18T00:32:11Z")
I ended up implementing CORS manually myself. Essentially a cors request is a OPTIONS call to your server with your url before the actual POST/GET request. So I just applied this rule to capture all OPTIONS requests: - alb: listenerArn: !Ref ALBListener priority: 1 conditions: path: /\* method: - OPTIONS The handler function would then return headers with cors info: callback(null, { statusCode: 200, statusDescription: ‘OK’, isBase64Encoded: false, headers: { ‘Content-Type’: ‘application/json’, ‘Access-Control-Allow-Origin’: ‘_’, ‘Access-Control-Allow-Headers’: '_’, ‘Access-Control-Allow-Methods’: ‘\*’ } }); Obvs in production you probably want to not have so many wildcards. I think also in every response in other requests I had to include these headers to make everything work. ---
**Author:** ![rigobertocontreras](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rigobertocontreras/32/4652_2.png) [@rigobertocontreras](https://forum.serverless.com/u/rigobertocontreras)\ **Post date:** [October 26, 2020, 7:07pm UTC](https://forum.serverless.com/t/application-load-balancer-cors/10550/3 "2020-10-26T19:07:50Z")
Thanks [shadrech](http://forum.serverless.com/u/shadrech) that one works ---
**Author:** ![aditya-tezsure](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/aditya-tezsure/32/5486_2.png) [@aditya-tezsure](https://forum.serverless.com/u/aditya-tezsure)\ **Post date:** [April 1, 2021, 7:57am UTC](https://forum.serverless.com/t/application-load-balancer-cors/10550/4 "2021-04-01T07:57:06Z")
@rigobertocontreras @shadrech guys where you add the above specified option on AWS ALB ? Kindly mention the steps please. ---
**Author:** ![jamesdmorgan](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/jamesdmorgan/32/5770_2.png) [@jamesdmorgan](https://forum.serverless.com/u/jamesdmorgan)\ **Post date:** [May 27, 2021, 3:07pm UTC](https://forum.serverless.com/t/application-load-balancer-cors/10550/5 "2021-05-27T15:07:52Z")
@aditya-tezsure the rules are defined against the listener. In the console if you click `View/edit rules` you can add the OPTIONS bypass `IF Http request method is OPTIONS` ![Rules-EC2-Management-Console (1)](https://canada1.discourse-cdn.com/flex036/uploads/serverless/original/2X/e/ec23c3c6972f2019c8f86fa5bc92b2d00c3e879f.png) ---
**Author:** ![vseltser](https://avatars.discourse-cdn.com/v4/letter/v/b487fb/32.png) [@vseltser](https://forum.serverless.com/u/vseltser)\ **Post date:** [December 7, 2021, 4:21pm UTC](https://forum.serverless.com/t/application-load-balancer-cors/10550/6 "2021-12-07T16:21:14Z")
Hello folks, could pls provide screen shots on how to get to ALB rules settings in more details - having trouble finding it, thks ---
**Author:** ![awsguru](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/awsguru/32/7123_2.png) [@awsguru](https://forum.serverless.com/u/awsguru)\ **Post date:** [August 12, 2022, 6:03pm UTC](https://forum.serverless.com/t/application-load-balancer-cors/10550/7 "2022-08-12T18:03:46Z")
@shadrech @jamesmorgan can one of you provide a little more information on how you are doing this? We have created the lambda function and the first rule in the ALB for the OPTIONS method, but we are not seeing how to use those headers with the next request in rule 2.