No Cors headers present. about serverless-aws-static-file-handler HOT 2 OPEN

@activescott why doesn't the plugin always add these ?

from serverless-aws-static-file-handler.

@tomchiverton It's a fair question. I don't have a great answer other than I never ran into it. I think I didn't pay much attention to this one honestly since there was a workaround. Now that a second person has inquired, I'm more keen to get something ironed out.

I don't see the harm in doing it by default so as long as it meets the following criteria:

1. Responds with CORS headers only for GET or OPTIONS requests (as other requests could be state changing by the outer function - unlikely but certainly possible and I noticed the current code never actually checks request method, which kinda stinks now that I think about it).
2. Access-Control-Allow-Methods only returns the values GET, OPTIONS
3. There is a way for the calling function to opt out (e.g. another optional constructor param).

Am I missing anything or overthinking it?
If not, you want to send a PR (with tests) or should I prepare one?

Although not technically an API-breaking change, I do wonder if it is a significant enough behavior change (especially since it arguably involves security) to be a MAJOR version bump to prevent inadvertent upgrades. What do you think?

from serverless-aws-static-file-handler.