Skip to content
This repository was archived by the owner on Oct 10, 2025. It is now read-only.

Commit f9c9491

Browse files
knihitknihit
committed
updates for release v1.0.7
1 parent 863215f commit f9c9491

File tree

6 files changed

+53
-18
lines changed

6 files changed

+53
-18
lines changed

‎source/infrastructure/lib/api/rest-endpoint.ts‎

Lines changed: 21 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -253,7 +253,7 @@ export class RestEndpoint extends Construct {
253253
// case creation
254254
caseResource.addCorsPreflight({
255255
allowOrigins: ['*'],
256-
allowHeaders: ['*'],
256+
allowHeaders: ['Content-Type, Access-Control-Allow-Headers, X-Requested-With, Authorization'],
257257
allowMethods: ['POST']
258258
});
259259
caseResource.addMethod('POST', postRequestLambdaIntegration, {
@@ -293,7 +293,7 @@ export class RestEndpoint extends Construct {
293293
const caseCaseIdResource = caseResource.addResource('{caseId}');
294294
caseCaseIdResource.addCorsPreflight({
295295
allowOrigins: ['*'],
296-
allowHeaders: ['*'],
296+
allowHeaders: ['Content-Type, Access-Control-Allow-Headers, X-Requested-With, Authorization'],
297297
allowMethods: ['GET']
298298
});
299299

@@ -326,7 +326,7 @@ export class RestEndpoint extends Construct {
326326
const casesResource = apiRoot.addResource('cases');
327327
casesResource.addCorsPreflight({
328328
allowOrigins: ['*'],
329-
allowHeaders: ['*'],
329+
allowHeaders: ['Content-Type, Access-Control-Allow-Headers, X-Requested-With, Authorization'],
330330
allowMethods: ['GET']
331331
});
332332
casesResource.addMethod('GET', getRequestLambdaIntegration, {
@@ -352,7 +352,7 @@ export class RestEndpoint extends Construct {
352352
// Upload a document to a case
353353
documentResource.addCorsPreflight({
354354
allowOrigins: ['*'],
355-
allowHeaders: ['*'],
355+
allowHeaders: ['Content-Type, Access-Control-Allow-Headers, X-Requested-With, Authorization'],
356356
allowMethods: ['POST']
357357
});
358358
documentResource.addMethod('POST', postRequestLambdaIntegration, {
@@ -383,7 +383,7 @@ export class RestEndpoint extends Construct {
383383
const documentCaseIdDocIdResource = documentResource.addResource('{caseId}').addResource('{documentId}');
384384
documentCaseIdDocIdResource.addCorsPreflight({
385385
allowOrigins: ['*'],
386-
allowHeaders: ['*'],
386+
allowHeaders: ['Content-Type, Access-Control-Allow-Headers, X-Requested-With, Authorization'],
387387
allowMethods: ['GET']
388388
});
389389
documentCaseIdDocIdResource.addMethod('GET', getRequestLambdaIntegration, {
@@ -415,7 +415,10 @@ export class RestEndpoint extends Construct {
415415
const documentDownloadResource = documentResource.addResource('download');
416416
documentDownloadResource.addCorsPreflight({
417417
allowOrigins: ['*'],
418-
allowHeaders: ['*'],
418+
allowHeaders: [
419+
'Content-Type, Access-Control-Allow-Headers, X-Requested-With, Authorization',
420+
'Access-Control-Allow-Origin'
421+
],
419422
allowMethods: ['GET']
420423
});
421424
documentDownloadResource.addMethod('GET', getDocumentLambdaIntegration, {
@@ -450,7 +453,10 @@ export class RestEndpoint extends Construct {
450453
.addResource('{documentId}');
451454
inferencesResource.addCorsPreflight({
452455
allowOrigins: ['*'],
453-
allowHeaders: ['*'],
456+
allowHeaders: [
457+
'Content-Type, Access-Control-Allow-Headers, X-Requested-With, Authorization',
458+
'Access-Control-Allow-Origin'
459+
],
454460
allowMethods: ['GET']
455461
});
456462
inferencesResource.addMethod('GET', getInferenceLambdaIntegration, {
@@ -466,7 +472,10 @@ export class RestEndpoint extends Construct {
466472
const inferenceResource = inferencesResource.addResource('{inferenceType}');
467473
inferenceResource.addCorsPreflight({
468474
allowOrigins: ['*'],
469-
allowHeaders: ['*'],
475+
allowHeaders: [
476+
'Content-Type, Access-Control-Allow-Headers, X-Requested-With, Authorization',
477+
'Access-Control-Allow-Origin'
478+
],
470479
allowMethods: ['GET']
471480
});
472481
inferenceResource.addMethod('GET', getInferenceLambdaIntegration, {
@@ -487,7 +496,10 @@ export class RestEndpoint extends Construct {
487496
const redactResource = apiRoot.addResource('redact').addResource('{caseId}').addResource('{documentId}');
488497
redactResource.addCorsPreflight({
489498
allowOrigins: ['*'],
490-
allowHeaders: ['*'],
499+
allowHeaders: [
500+
'Content-Type, Access-Control-Allow-Headers, X-Requested-With, Authorization',
501+
'Access-Control-Allow-Origin'
502+
],
491503
allowMethods: ['POST']
492504
});
493505
redactResource.addMethod('POST', postRedactLambdaIntegration, {

‎source/infrastructure/lib/s3web/static-site.ts‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,19 @@ export class StaticWebsite extends Construct {
8181
iam.Role.fromRoleArn(this, 'BucketPolicyLambdaRole', props.customResourceRoleArn)
8282
);
8383

84+
const cspResponseHeadersPolicy = new cloudfront.ResponseHeadersPolicy(this, 'CSPResponseHeadersPolicy', {
85+
responseHeadersPolicyName: `eDU-CSPResponseHeadersPolicy-${cdk.Aws.STACK_NAME}-${cdk.Aws.REGION}`,
86+
comment: 'CSP Response Headers Policy',
87+
securityHeadersBehavior: {
88+
contentSecurityPolicy: {
89+
contentSecurityPolicy:
90+
"default-src 'self' data: https://*.amazonaws.com; img-src 'self' data: https://*.cloudfront.net https://*.amazonaws.com; script-src 'self' http://*.cloudfront.net https://*.amazonaws.com; style-src 'self' 'unsafe-inline' https://*.amazonaws.com; object-src 'self' https://*.amazonaws.com; worker-src 'self' blob:",
91+
override: true
92+
},
93+
frameOptions: { frameOption: cloudfront.HeadersFrameOption.DENY, override: true }
94+
}
95+
});
96+
8497
const cloudfrontToS3 = new CloudFrontToS3(this, 'UI', {
8598
existingBucketObj: this.webS3Bucket,
8699
cloudFrontDistributionProps: {
@@ -91,7 +104,10 @@ export class StaticWebsite extends Construct {
91104
],
92105
logFilePrefix: 'cloudfront/',
93106
minimumProtocolVersion: cloudfront.SecurityPolicyProtocol.TLS_V1_2_2019,
94-
defaultRootObject: 'login.html'
107+
defaultRootObject: 'login.html',
108+
defaultBehavior: {
109+
responseHeadersPolicy: cspResponseHeadersPolicy
110+
}
95111
}
96112
});
97113

‎source/infrastructure/lib/search/indexed-storage.ts‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,10 @@ export class IndexedStorage extends Construct {
128128
.addResource('{query}');
129129
kendraSearchResource.addCorsPreflight({
130130
allowOrigins: ['*'],
131-
allowHeaders: ['*'],
131+
allowHeaders: [
132+
'Content-Type, Access-Control-Allow-Headers, X-Requested-With, Authorization',
133+
'Access-Control-Allow-Origin'
134+
],
132135
allowMethods: ['GET']
133136
});
134137

‎source/lambda/layers/common-node-lib/response-formatter/error-response.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ function formatError(error) {
3333
'statusCode': error.statusCode,
3434
'headers': {
3535
'Content-Type': 'text/plain',
36-
'x-amzn-ErrorType': error.code
36+
'x-amzn-ErrorType': error.code,
37+
'Access-Control-Allow-Origin': '*' // NOSONAR - javascript:S5122 - Domain not known at this point.
3738
},
3839
'isBase64Encoded': false,
3940
'body': error.code + ': ' + error.message

‎source/lambda/layers/common-node-lib/test/response-formatter/error-response.spec.js‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ describe('When formatting error responses as HTTP responses', () => {
2626
'statusCode': '400',
2727
'headers': {
2828
'Content-Type': 'text/plain',
29-
'x-amzn-ErrorType': 'CustomExecutionError'
29+
'x-amzn-ErrorType': 'CustomExecutionError',
30+
'Access-Control-Allow-Origin': '*' // NOSONAR - javascript:S5122 - Domain not known at this point.
3031
},
3132
'isBase64Encoded': false,
3233
'body': 'CustomExecutionError: Test error'
@@ -42,7 +43,8 @@ describe('When formatting error responses as HTTP responses', () => {
4243
'statusCode': '501',
4344
'headers': {
4445
'Content-Type': 'text/plain',
45-
'x-amzn-ErrorType': 'TestCustomError'
46+
'x-amzn-ErrorType': 'TestCustomError',
47+
'Access-Control-Allow-Origin': '*' // NOSONAR - javascript:S5122 - Domain not known at this point.
4648
},
4749
'isBase64Encoded': false,
4850
'body': 'TestCustomError: Test error'
@@ -55,7 +57,8 @@ describe('When formatting error responses as HTTP responses', () => {
5557
'statusCode': '400',
5658
'headers': {
5759
'Content-Type': 'text/plain',
58-
'x-amzn-ErrorType': 'CustomExecutionError'
60+
'x-amzn-ErrorType': 'CustomExecutionError',
61+
'Access-Control-Allow-Origin': '*' // NOSONAR - javascript:S5122 - Domain not known at this point.
5962
},
6063
'isBase64Encoded': false,
6164
'body': 'CustomExecutionError: Test error'

‎source/ui/public/index.html‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@
1111
<link rel="icon" href="%PUBLIC_URL%/favicon.png" />
1212
<meta name="viewport" content="width=device-width, initial-scale=1" />
1313
<meta name="theme-color" content="#000000" />
14-
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; base-uri 'none'; upgrade-insecure-requests; img-src 'self' data: https://*.amazonaws.com; script-src 'self';
15-
style-src 'self' 'unsafe-inline' https:; object-src 'none'; font-src 'self' https: data:;
16-
manifest-src 'self'; connect-src 'self' https://*.amazonaws.com" />
14+
<meta http-equiv="default-src 'self'; base-uri 'none'; upgrade-insecure-requests; img-src 'self' data: https://*.amazonaws.com; script-src 'self' 'unsafe-inline';
15+
style-src 'self' 'unsafe-inline' https:; object-src 'none'; font-src 'self' https: data:;
16+
manifest-src 'self'; connect-src 'self' https://*.amazonaws.com" />
1717
<title>Enhanced Document Understanding on AWS</title>
1818
</head>
1919

0 commit comments

Comments
 (0)