Set response cors headers according to serverless configuration

Author: mcattarinussi

index.js

@@ -93,8 +93,8 @@ module.exports = function(options) {
         callbacks.push(executeLambdaCallback(func));
         // Setup endpoint
         if (e.cors) {
-          httpConfig.eventHandler('options', path, [decorateAddCORSCallback(true), send200]);
-          callbacks.unshift(decorateAddCORSCallback());
+          httpConfig.eventHandler('options', path, [decorateAddCORSCallback(e.cors, true), send200]);
+          callbacks.unshift(decorateAddCORSCallback(e.cors));
         }
         httpConfig.eventHandler(method, path, callbacks);
       }

lib/decorators-callbacks.js

@@ -18,13 +18,24 @@ module.exports.decorateLambdaReqCallback = function(getPrincipalId) {
   };
 };
 
-module.exports.decorateAddCORSCallback = function(isOptionMethod) {
+module.exports.decorateAddCORSCallback = function(corsOpts, isOptionMethod) {
+  // TODO: get default cors options from variables
+  const cors = {
+    origins: ['*'],
+    methods: ['GET', 'PUT', 'HEAD', 'PATCH', 'POST', 'DELETE', 'OPTIONS'],
+    headers: ['Authorization', 'Content-Type', 'x-amz-date', 'x-amz-security-token']
+  };
+  if(corsOpts instanceof Object) {
+    Object.assign(cors, corsOpts);
+  } else if(corsOpts != true) {
+    throw new Error('Invalid cors configuration!');
+  }
   return function(req, res, next) {
     if(isOptionMethod) {
-      res.header('Access-Control-Allow-Methods', 'GET,PUT,HEAD,PATCH,POST,DELETE,OPTIONS');
-      res.header('Access-Control-Allow-Headers', 'Authorization,Content-Type,x-amz-date,x-amz-security-token');
+      res.header('Access-Control-Allow-Methods', cors.methods.join(','));
+      res.header('Access-Control-Allow-Headers', cors.headers.join(','));
     }
-    res.header('Access-Control-Allow-Origin', '*');
+    res.header('Access-Control-Allow-Origin', cors.origins.join(','));
     next();
   };
 };