Provide multi origin cors values

docs/providers/aws/events/apigateway.md

@@ -231,6 +231,37 @@ functions:
             allowCredentials: false
 ```
 
+To allow multipe origins, you can use the following configuration and provide an array in the `origins` or use comma separated `origin` field:
+
+```yml
+functions:
+  hello:
+    handler: handler.hello
+    events:
+      - http:
+          path: hello
+          method: get
+          cors:
+            origins:
+              - http://example.com
+              - http://example2.com
+            headers:
+              - Content-Type
+              - X-Amz-Date
+              - Authorization
+              - X-Api-Key
+              - X-Amz-Security-Token
+              - X-Amz-User-Agent
+            allowCredentials: false
+```
+
+Please note that since you can't send multiple values for [Access-Control-Allow-Origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin), this configuration uses a response template to check if the request origin matches one of your provided `origins` and overrides the header with the following code:
+
+```
+#set($origin = $input.params("Origin")
+#if($origin == "http://example.com" || $origin == "http://*.amazonaws.com") #set($context.responseOverride.header.Access-Control-Allow-Origin = $origin) #end
+```
+
 Configuring the `cors` property sets  [Access-Control-Allow-Origin](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin), [Access-Control-Allow-Headers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers), [Access-Control-Allow-Methods](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods),[Access-Control-Allow-Credentials](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials) headers in the CORS preflight response.
 
 To enable the `Access-Control-Max-Age` preflight response header, set the `maxAge` property in the `cors` object:

lib/plugins/aws/package/compile/events/apiGateway/lib/cors.js

@@ -11,10 +11,20 @@ module.exports = {
       const corsMethodLogicalId = this.provider.naming
         .getMethodLogicalId(resourceName, 'options');
 
-      // TODO remove once "origins" config is deprecated
       let origin = config.origin;
-      if (config.origins && config.origins.length) {
-        origin = config.origins.join(',');
+      let origins = (config.origins && Array.isArray(config.origins)) ? config.origins : undefined;
+
+      if (origin && origin.indexOf(',') !== -1) {
+        origins = origin.split(',').map(a => a.trim());
+      }
+
+      if (origins) {
+        origin = origins[0];
+      }
+
+      if (!origin && !origins) {
+        const errorMessage = 'must specify either origin or origins';
+        throw new this.serverless.classes.Error(errorMessage);
       }
 
       const preflightHeaders = {
@@ -61,7 +71,8 @@ module.exports = {
                 'application/json': '{statusCode:200}',
               },
               ContentHandling: 'CONVERT_TO_TEXT',
-              IntegrationResponses: this.generateCorsIntegrationResponses(preflightHeaders),
+              IntegrationResponses:
+                this.generateCorsIntegrationResponses(preflightHeaders, origins),
             },
             ResourceId: resourceRef,
             RestApiId: this.provider.getApiGatewayRestApiId(),
@@ -89,7 +100,7 @@ module.exports = {
     ];
   },
 
-  generateCorsIntegrationResponses(preflightHeaders) {
+  generateCorsIntegrationResponses(preflightHeaders, origins) {
     const responseParameters = _.mapKeys(preflightHeaders,
       (value, header) => `method.response.header.${header}`);
 
@@ -98,9 +109,21 @@ module.exports = {
         StatusCode: '200',
         ResponseParameters: responseParameters,
         ResponseTemplates: {
-          'application/json': '',
+          'application/json':
+            Array.isArray(origins) ? this.generateCorsResponseTemplate(origins) : '',
         },
       },
     ];
   },
+
+  generateCorsResponseTemplate(origins) {
+    return (
+      '#set($origin = $input.params("Origin"))\n' +
+      '#if($origin == "") #set($origin = $input.params("origin")) #end\n' +
+      `#if(${origins
+        .map((o, i, a) => `$origin == "${o}"${i < a.length - 1 ? ' || ' : ''}`)
+        .join('')}` +
+      ') #set($context.responseOverride.header.Access-Control-Allow-Origin = $origin) #end'
+    );
+  },
 };

lib/plugins/aws/package/compile/events/apiGateway/lib/cors.test.js

@@ -71,7 +71,7 @@ describe('#compileCors()', () => {
         cacheControl: 'max-age=600, s-maxage=600',
       },
       'users/create': {
-        origins: ['*', 'http://example.com'],
+        origins: ['http://localhost:3000', 'http://example.com'],
         headers: ['*'],
         methods: ['OPTIONS', 'POST'],
         allowCredentials: true,
@@ -87,7 +87,7 @@ describe('#compileCors()', () => {
         cacheControl: 'max-age=600, s-maxage=600',
       },
       'users/any': {
-        origins: ['http://example.com'],
+        origin: 'http://localhost:3000,http://example.com',
         headers: ['*'],
         methods: ['OPTIONS', 'ANY'],
         allowCredentials: false,
@@ -100,7 +100,14 @@ describe('#compileCors()', () => {
           .Resources.ApiGatewayMethodUsersCreateOptions
           .Properties.Integration.IntegrationResponses[0]
           .ResponseParameters['method.response.header.Access-Control-Allow-Origin']
-      ).to.equal('\'*,http://example.com\'');
+      ).to.equal('\'http://localhost:3000\'');
+
+      expect(
+        awsCompileApigEvents.serverless.service.provider.compiledCloudFormationTemplate
+          .Resources.ApiGatewayMethodUsersCreateOptions
+          .Properties.Integration.IntegrationResponses[0]
+          .ResponseTemplates['application/json']
+      ).to.equal('#set($origin = $input.params("Origin"))\n#if($origin == "") #set($origin = $input.params("origin")) #end\n#if($origin == "http://localhost:3000" || $origin == "http://example.com") #set($context.responseOverride.header.Access-Control-Allow-Origin = $origin) #end');
 
       expect(
         awsCompileApigEvents.serverless.service.provider.compiledCloudFormationTemplate
@@ -221,8 +228,8 @@ describe('#compileCors()', () => {
         awsCompileApigEvents.serverless.service.provider.compiledCloudFormationTemplate
           .Resources.ApiGatewayMethodUsersAnyOptions
           .Properties.Integration.IntegrationResponses[0]
-          .ResponseParameters['method.response.header.Access-Control-Allow-Origin']
-      ).to.equal('\'http://example.com\'');
+          .ResponseTemplates['application/json']
+      ).to.equal('#set($origin = $input.params("Origin"))\n#if($origin == "") #set($origin = $input.params("origin")) #end\n#if($origin == "http://localhost:3000" || $origin == "http://example.com") #set($context.responseOverride.header.Access-Control-Allow-Origin = $origin) #end');
 
       expect(
         awsCompileApigEvents.serverless.service.provider.compiledCloudFormationTemplate
@@ -247,6 +254,19 @@ describe('#compileCors()', () => {
     });
   });
 
+  it('should throw error if no origin or origins is provided', () => {
+    awsCompileApigEvents.validated.corsPreflight = {
+      'users/update': {
+        headers: ['*'],
+        methods: ['OPTIONS', 'PUT'],
+        allowCredentials: false,
+      },
+    };
+
+    expect(() => awsCompileApigEvents.compileCors())
+      .to.throw(Error, 'must specify either origin or origins');
+  });
+
   it('should throw error if maxAge is not an integer greater than 0', () => {
     awsCompileApigEvents.validated.corsPreflight = {
       'users/update': {