chore(apigatewayv2): disallow allowCredentials when allowOrigin has '*'

packages/@aws-cdk/aws-apigatewayv2/README.md

@@ -106,7 +106,6 @@ The `corsPreflight` option lets you specify a CORS configuration for an API.
 ```ts
 new HttpApi(stack, 'HttpProxyApi', {
   corsPreflight: {
-    allowCredentials: true,
     allowHeaders: ['Authorization'],
     allowMethods: [HttpMethod.GET, HttpMethod.HEAD, HttpMethod.OPTIONS, HttpMethod.POST],
     allowOrigins: ['*'],
@@ -136,8 +135,6 @@ the API's URL - `https://{api_id}.execute-api.{region}.amazonaws.com/`.
 
 Note that, `HttpApi` will always creates a `$default` stage, unless the `createDefaultStage` property is unset.
 
-
-
 ### Custom Domain
 
 Custom domain names are simpler and more intuitive URLs that you can provide to your API users. Custom domain name are associated to API stages.

packages/@aws-cdk/aws-apigatewayv2/lib/http/api.ts

@@ -143,6 +143,10 @@ export class HttpApi extends Resource implements IHttpApi {
 
     let corsConfiguration: CfnApi.CorsProperty | undefined;
     if (props?.corsPreflight) {
+      const cors = props.corsPreflight;
+      if (cors.allowOrigins && cors.allowOrigins.includes('*') && cors.allowCredentials) {
+        throw new Error("CORS preflight - allowCredentials is not supported when allowOrigin is '*'");
+      }
       const {
         allowCredentials,
         allowHeaders,

packages/@aws-cdk/aws-apigatewayv2/test/http/api.test.ts

@@ -1,6 +1,7 @@
 import '@aws-cdk/assert/jest';
+import { ABSENT } from '@aws-cdk/assert';
 import { Code, Function, Runtime } from '@aws-cdk/aws-lambda';
-import { Stack } from '@aws-cdk/core';
+import { Duration, Stack } from '@aws-cdk/core';
 import { HttpApi, HttpMethod, LambdaProxyIntegration } from '../../lib';
 
 describe('HttpApi', () => {
@@ -113,4 +114,46 @@ describe('HttpApi', () => {
       RouteKey: 'ANY /pets',
     });
   });
+
+  describe('cors', () => {
+    test('cors is correctly configured.', () => {
+      const stack = new Stack();
+      new HttpApi(stack, 'HttpApi', {
+        corsPreflight: {
+          allowHeaders: ['Authorization'],
+          allowMethods: [HttpMethod.GET, HttpMethod.HEAD, HttpMethod.OPTIONS, HttpMethod.POST],
+          allowOrigins: ['*'],
+          maxAge: Duration.seconds(36400),
+        },
+      });
+
+      expect(stack).toHaveResource('AWS::ApiGatewayV2::Api', {
+        CorsConfiguration: {
+          AllowHeaders: ['Authorization'],
+          AllowMethods: ['GET', 'HEAD', 'OPTIONS', 'POST'],
+          AllowOrigins: ['*'],
+          MaxAge: 36400,
+        },
+      });
+    });
+
+    test('cors is absent when not specified.', () => {
+      const stack = new Stack();
+      new HttpApi(stack, 'HttpApi');
+
+      expect(stack).toHaveResource('AWS::ApiGatewayV2::Api', {
+        CorsConfiguration: ABSENT,
+      });
+    });
+
+    test('errors when allowConfiguration is specified along with origin "*"', () => {
+      const stack = new Stack();
+      expect(() => new HttpApi(stack, 'HttpApi', {
+        corsPreflight: {
+          allowCredentials: true,
+          allowOrigins: ['*'],
+        },
+      })).toThrowError(/allowCredentials is not supported/);
+    });
+  });
 });

packages/@aws-cdk/aws-apigatewayv2/test/http/integrations/http.test.ts

@@ -1,6 +1,5 @@
-import { ABSENT } from '@aws-cdk/assert';
 import '@aws-cdk/assert/jest';
-import { Duration, Stack } from '@aws-cdk/core';
+import { Stack } from '@aws-cdk/core';
 import { HttpApi, HttpIntegration, HttpIntegrationType, HttpMethod, HttpProxyIntegration, HttpRoute, HttpRouteKey, PayloadFormatVersion } from '../../../lib';
 
 describe('HttpProxyIntegration', () => {
@@ -72,37 +71,3 @@ describe('HttpProxyIntegration', () => {
     });
   });
 });
-
-describe('CORS', () => {
-  test('CORS Configuration is correctly configured.', () => {
-    const stack = new Stack();
-    new HttpApi(stack, 'HttpApi', {
-      corsPreflight: {
-        allowCredentials: true,
-        allowHeaders: ['Authorization'],
-        allowMethods: [HttpMethod.GET, HttpMethod.HEAD, HttpMethod.OPTIONS, HttpMethod.POST],
-        allowOrigins: ['*'],
-        maxAge: Duration.seconds(36400),
-      },
-    });
-
-    expect(stack).toHaveResource('AWS::ApiGatewayV2::Api', {
-      CorsConfiguration: {
-        AllowCredentials: true,
-        AllowHeaders: ['Authorization'],
-        AllowMethods: ['GET', 'HEAD', 'OPTIONS', 'POST'],
-        AllowOrigins: ['*'],
-        MaxAge: 36400,
-      },
-    });
-  });
-
-  test('CorsConfiguration is ABSENT when not specified.', () => {
-    const stack = new Stack();
-    new HttpApi(stack, 'HttpApi');
-
-    expect(stack).toHaveResource('AWS::ApiGatewayV2::Api', {
-      CorsConfiguration: ABSENT,
-    });
-  });
-});