add: `Options` method to apigateway staging

[MehulKChaudhari]

Add: Options method to APIGateway staging.

Since we use credentials: include browsers sends a OPTION request. But our API gateway don't have so we need to it add it.

Steps to the OPTIONS method in the API gateway.

1. Visit API gateway region: us-east-1

Select /feature-flags and then select enable cors

2. Filling the details as per screenshot:

Access-Control-Allow-Origin: *
Note: We are using * in Access-Control-Allow-Origin because our code handles it with regex and API gateway does not support *.rds.com and a regex.

Access-Control-Allow-Methods: GET, OPTIONS, POST
Access-Control-Allow-Headers: Authorization, Content-Type, Cache-Control, Cookie
Access-Control-Expose-Headers: Set-Cookie

3. Click on save

4. we have do similar for other routes marked in below below

at last
5. Click on deploy API

6. Select a stage dev and click on Deploy

[prakashchoudhary07]

Why is Access-Control-Allow-Origin set to * and not a specific domain?

[MehulKChaudhari]

Why is Access-Control-Allow-Origin set to * and not a specific domain?

Hi, because we cannot put a regex there and if we set it to realdevsquad.com it will not allow for our subdomains.

and ours cors middleware package handles it so we are good.

https://github.com/Real-Dev-Squad/feature-flag-backend/blob/develop/middlewares/cors.go

[vikasosmium]

Can we mention multiple subdomains there or can we do this *.example.com?

[iamitprakash]

Hello @MehulKChaudhari why we need * in Access-Control-Allow-Headers, if you handling somewhere please make this config specific. We won't be going with *

cc- @prakashchoudhary07

[MehulKChaudhari]

Hello @MehulKChaudhari why we need * in Access-Control-Allow-Headers, if you handling somewhere please make this config specific. We won't be going with *

cc- @prakashchoudhary07

Hi @iamitprakash, The APIGatway does not support the regex or partial wildcards. We can add all the domains comma-separated.

Updated We cannot used comma separated subdomains as well.

I am not worried about adding * as our Cors middleware handles the case to check for the rds domain and only allow RDS domain.
https://github.com/Real-Dev-Squad/feature-flag-backend/blob/develop/middlewares/cors.go

[MehulKChaudhari]

Can we mention multiple subdomains there or can we do this *.example.com?

Hey, No it does not support the partial wildcard *.example.com, to at least its not mentioned anywhere.

Yes we can add the links comma separated.

Update: We cannot use the comma separated subdomains as

@vikasosmium

[amit-flx]

Can we mention multiple subdomains there or can we do this *.example.com?

Hey, No it does not support the partial wildcard *.example.com, to at least its not mentioned anywhere.

Yes we can add the links comma separated.

Update: We cannot use the comma separated subdomains as

[@vikasosmium](https://github.com/vikasosmium)

do you mean to say only using * is the option, and no is using multiple values in this world @MehulKChaudhari