Not getting a specific header from AWS API Gateway - amazon-web-services

Question

I have built an SPA which has react as its front-end and the serverless(AWS lambda) framework has its back-end.
The react app has been deployed in S3. This app communicates to the lambda functions(serverless) through AWS API Gateway.
Since the react app which is in S3 domain and the back-end (AWS API Gateway, AWS lambda, DynamoDB) is in different domain. CORS problem occurs.
To rectify the CORS problem, I have hardcoded the Access-Control-Allow-Origin header as react app's domain URL. So, the backend understands the origin is from known source and resolves the origin-CORS error.
But, There is another header called "Access-Control-Allow-Credentials" which has to be true to access request's cookies.
IF Access-Control-Allow-Origin is "*", then Access-Control-Allow-Credentials must be false, for privacy concern.
so, I have set Access-Control-Allow-Origin to React's domain, then Access-Control-Allow-Credentials may be true.
I added Access-Control-Allow-Credentials header in API-gateway response method and in integration response method. The problem is I am not getting the Access-Control-Allow-Credentials header in client side as response. I am getting all other headers except this one. Testing API Gateway console gives the header, but testing on postman and in browser, does not receive the above header.
The headers in client are
but on testing AWS API Gateway gives this .
The problem is Access-Control-Allow-Credentials header is not retrieved as response in browser and in postman, but appears when testing in AWS API Gateway console. What might be the problem ?

Answer 1

Please post exported Swagger for your API. I can confirm there is nothing special about "Access-Control-Allow-Credentials" header, so you should be able to map this according to your needs.
Example API:
swagger: "2.0"
info:
version: "2016-09-17T00:36:34Z"
title: "foo"
host: "45c24yfor1.execute-api.us-east-1.amazonaws.com"
basePath: "/test"
schemes:
- "https"
paths:
/:
get:
consumes:
- "application/json"
produces:
- "application/json"
responses:
200:
description: "200 response"
schema:
$ref: "#/definitions/Empty"
headers:
Cookie:
type: "string"
Access-Control-Allow-Credentials:
type: "string"
Set-Cookie:
type: "string"
x-amazon-apigateway-integration:
responses:
default:
statusCode: "200"
responseParameters:
method.response.header.Access-Control-Allow-Credentials: "'test'"
requestTemplates:
application/json: "{\"statusCode\": 200}"
passthroughBehavior: "when_no_match"
type: "mock"
definitions:
Empty:
type: "object"
title: "Empty Schema"
Command:
curl -v https://45c24yfor1.execute-api.us-east-1.amazonaws.com/test
< HTTP/1.1 200 OK
< Date: Sat, 17 Sep 2016 00:36:46 GMT
< Content-Type: application/json
< Content-Length: 0
< Connection: keep-alive
< Access-Control-Allow-Credentials: test
< x-amzn-RequestId: d04135bc-7c6e-11e6-a593-559956e50e8a
< X-Cache: Miss from cloudfront
< Via: 1.1 b63769e2d89c89274acd908e4bfcb9f4.cloudfront.net (CloudFront)
< X-Amz-Cf-Id: 3Nevesi15lEGox0jrFq8B2HEknHbbFfISlg4yv7Lw3X90S2sUIWE_g==