# How to enable CORS for custom authorizers ? (AWS API Gateways) **URL:** \ **Category:** Serverless Framework\ **Tags:** aws\ **Created:** [April 7, 2017, 12:12pm UTC](https://forum.serverless.com/t/how-to-enable-cors-for-custom-authorizers-aws-api-gateways/1660 "2017-04-07T12:12:39Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![stephanechauvin](https://avatars.discourse-cdn.com/v4/letter/s/f6c823/32.png) [@stephanechauvin](https://forum.serverless.com/u/stephanechauvin)\ **Post date:** [April 7, 2017, 12:12pm UTC](https://forum.serverless.com/t/how-to-enable-cors-for-custom-authorizers-aws-api-gateways/1660/1 "2017-04-07T12:12:39Z")
I’m trying to implement a basic custom authorizer but I have an issue with cors when the authorizer don’t authorize the API call : I get the expected 401 status code but there are no `Access-Control-Allow-Origin` header in the response, then I can’t handle it in my front-end code… I didn’t find any mention of `cors` attribute in the serverless doc for the authorizer itself, so how can I tell it to add the correct header for “non authorized” responses ? Thanks in advance Stephane ---
**Author:** ![bbilger](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bbilger/32/1066_2.png) [@bbilger](https://forum.serverless.com/u/bbilger)\ **Post date:** [April 8, 2017, 9:24am UTC](https://forum.serverless.com/t/how-to-enable-cors-for-custom-authorizers-aws-api-gateways/1660/2 "2017-04-08T09:24:09Z")
Hi @stephanechauvin, Unfortunately you can’t, that’s a limitation in API gateway and a pain-point for a lot of users. [https://forums.aws.amazon.com/thread.jspa?messageID=728839](https://forums.aws.amazon.com/thread.jspa?messageID=728839) ---
**Author:** ![stephanechauvin](https://avatars.discourse-cdn.com/v4/letter/s/f6c823/32.png) [@stephanechauvin](https://forum.serverless.com/u/stephanechauvin)\ **Post date:** [April 10, 2017, 9:12am UTC](https://forum.serverless.com/t/how-to-enable-cors-for-custom-authorizers-aws-api-gateways/1660/3 "2017-04-10T09:12:40Z")
Ok thx bbilger. Incredible that AWS isn’t able to quickly address this kind of issue ! 😟 ---
**Author:** ![RastoStric](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rastostric/32/493_2.png) [@RastoStric](https://forum.serverless.com/u/RastoStric)\ **Post date:** [June 19, 2017, 9:59am UTC](https://forum.serverless.com/t/how-to-enable-cors-for-custom-authorizers-aws-api-gateways/1660/4 "2017-06-19T09:59:01Z")
Things have changed, AWS finally fixed this thing, but I am not sure how to implement it with serverless. Does anybody have an idea? Thank you > ---
**Author:** ![DavidWells](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/davidwells/32/201_2.png) [@DavidWells](https://forum.serverless.com/u/DavidWells)\ **Post date:** [October 21, 2017, 9:25pm UTC](https://forum.serverless.com/t/how-to-enable-cors-for-custom-authorizers-aws-api-gateways/1660/5 "2017-10-21T21:25:37Z")
@RastoStric I have the same question Did you figure out how to return cors headers from authorizer? ---
**Author:** ![DavidWells](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/davidwells/32/201_2.png) [@DavidWells](https://forum.serverless.com/u/DavidWells)\ **Post date:** [October 21, 2017, 10:20pm UTC](https://forum.serverless.com/t/how-to-enable-cors-for-custom-authorizers-aws-api-gateways/1660/6 "2017-10-21T22:20:19Z")
After hours of searching… The answer is here: [https://github.com/serverless/serverless/issues/3896#issuecomment-326721971](https://github.com/serverless/serverless/issues/3896#issuecomment-326721971) ---
**Author:** ![RastoStric](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rastostric/32/493_2.png) [@RastoStric](https://forum.serverless.com/u/RastoStric)\ **Post date:** [October 23, 2017, 12:25pm UTC](https://forum.serverless.com/t/how-to-enable-cors-for-custom-authorizers-aws-api-gateways/1660/7 "2017-10-23T12:25:02Z")
Thanks for sharing, I didn’t know it! 👍 ---
**Author:** ![AEsmerio](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/aesmerio/32/7523_2.png) [@AEsmerio](https://forum.serverless.com/u/AEsmerio)\ **Post date:** [April 2, 2024, 12:20pm UTC](https://forum.serverless.com/t/how-to-enable-cors-for-custom-authorizers-aws-api-gateways/1660/8 "2024-04-02T12:20:49Z")
After searching for more than a day, I have finally found the proper answer. Thanks @DavidWells