Fix CORS when working with multiheaders

Author: leandrodamascena

aws_lambda_powertools/event_handler/api_gateway.py

@@ -217,6 +217,30 @@ def to_dict(self, origin: Optional[str]) -> Dict[str, str]:
             headers["Access-Control-Allow-Credentials"] = "true"
         return headers
 
+    @staticmethod
+    def extract_origin_header(resolver_headers: Dict):
+        """
+        Extracts the 'origin' or 'Origin' header from the provided resolver headers.
+
+        The 'origin' or 'Origin' header can be either a single header or a multi-header.
+
+        Args:
+            resolver_headers (Dict): A dictionary containing the headers.
+
+        Returns:
+            Union[str, List[str], None]: The value(s) of the 'origin' or 'Origin' header.
+                If the header is a single header, a string is returned.
+                If the header is a multi-header, a list of strings is returned.
+                If the header is not present, None is returned.
+        """
+        resolved_header = resolver_headers.get("origin") or resolver_headers.get("Origin")
+        if isinstance(resolved_header, str):
+            return resolved_header
+        if isinstance(resolved_header, list):
+            return resolved_header[0]
+
+        return resolved_header
+
 
 class Response(Generic[ResponseT]):
     """Response data class that provides greater control over what is returned from the proxy event"""
@@ -782,7 +806,8 @@ def __init__(
 
     def _add_cors(self, event: ResponseEventT, cors: CORSConfig):
         """Update headers to include the configured Access-Control headers"""
-        self.response.headers.update(cors.to_dict(event.get_header_value("Origin")))
+        extracted_origin_header = cors.extract_origin_header(event.resolved_headers_field)
+        self.response.headers.update(cors.to_dict(extracted_origin_header))
 
     def _add_cache_control(self, cache_control: str):
         """Set the specified cache control headers for 200 http responses. For non-200 `no-cache` is used."""
@@ -2129,7 +2154,8 @@ def _not_found(self, method: str) -> ResponseBuilder:
         headers = {}
         if self._cors:
             logger.debug("CORS is enabled, updating headers.")
-            headers.update(self._cors.to_dict(self.current_event.get_header_value("Origin")))
+            extracted_origin_header = self._cors.extract_origin_header(self.current_event.resolved_headers_field)
+            headers.update(self._cors.to_dict(extracted_origin_header))
 
             if method == "OPTIONS":
                 logger.debug("Pre-flight request detected. Returning CORS with null response")

docs/index.md

@@ -89,7 +89,7 @@ You can install Powertools for AWS Lambda (Python) using your favorite dependenc
             === "CDK"
 
                 ```python hl_lines="13 19"
-                --8<-- "examples/homepage/install/x86_64/cdk.py"
+                --8<-- "examples/homepage/install/x86_64/cdk_x86.py"
                 ```
 
             === "Terraform"
@@ -101,7 +101,7 @@ You can install Powertools for AWS Lambda (Python) using your favorite dependenc
             === "Pulumi"
 
                 ```python hl_lines="21-27"
-                --8<-- "examples/homepage/install/x86_64/pulumi.py"
+                --8<-- "examples/homepage/install/x86_64/pulumi_x86.py"
                 ```
 
             === "Amplify"
@@ -127,7 +127,7 @@ You can install Powertools for AWS Lambda (Python) using your favorite dependenc
             === "CDK"
 
                 ```python hl_lines="13 19"
-                --8<-- "examples/homepage/install/arm64/cdk.py"
+                --8<-- "examples/homepage/install/arm64/cdk_arm64.py"
                 ```
 
             === "Terraform"
@@ -139,7 +139,7 @@ You can install Powertools for AWS Lambda (Python) using your favorite dependenc
             === "Pulumi"
 
                 ```python hl_lines="21-27"
-                --8<-- "examples/homepage/install/arm64/pulumi.py"
+                --8<-- "examples/homepage/install/arm64/pulumi_arm64.py"
                 ```
 
             === "Amplify"
@@ -275,7 +275,7 @@ Compared with the [public Layer ARN](#lambda-layer) option, SAR allows you to ch
     === "CDK"
 
         ```python hl_lines="7 16-20 23-27"
-        --8<-- "examples/homepage/install/sar/cdk.py"
+        --8<-- "examples/homepage/install/sar/cdk_sar.py"
         ```
 
     === "Terraform"

examples/homepage/install/arm64/cdk.py renamed to examples/homepage/install/arm64/cdk_arm64.py

@@ -12,6 +12,12 @@ disable_error_code = annotation-unchecked
 [mypy-jmespath]
 ignore_missing_imports=True
 
+[mypy-pulumi.*]
+ignore_missing_imports=True
+
+[mypy-pulumi_aws.*]
+ignore_missing_imports=True
+
 [mypy-aws_encryption_sdk.*]
 ignore_missing_imports=True
 

examples/homepage/install/arm64/pulumi.py renamed to examples/homepage/install/arm64/pulumi_arm64.py

@@ -12,6 +12,9 @@
     "Header1": [
       "value1"
     ],
+    "Origin": [
+      "https://aws.amazon.com"
+    ],
     "Header2": [
       "value1",
       "value2"