INCIDENT RUNBOOK

Fix: Cors Preflight Origin Mismatch in FastAPI on AWS Lambda

Comprehensive architectural post-mortem and verified configuration patch for fastapi deployed in aws lambda production environments.

Automated Remediation ProtocolUpdated for 2026 Production

Facing cors-preflight-origin-mismatch in CI/CD or runtime containers?

Review the verified configuration patches below. To automate incident triage and fine-tune your own internal agents, check out our production AI training datasets.

🧠 Explore Security & Code Datasets →All Runtime Fixes →

● Observed Terminal Error / Stack Trace

ERROR:root:Exception on /items/[item_id] [OPTIONS]
fastapi.errors.CORSValidationError: 
  CorsPreflightWildcardOriginValidationError: 
  In order to accept all origins, you should set CORSMiddleware with origins=['*']
  For this to work, you need to add the Access-Control-Allow-Origin header to your responses, with the value of the origin of the request, or '*' to allow all origins.
  HINT: You can enable CORS with the CORSMiddleware in your FastAPI application.

Root Cause Analysis

The CORS preflight origin mismatch error occurs when the browser sends a preflight request to the server to determine which HTTP methods and headers are allowed for a specific resource. In the context of FastAPI on AWS Lambda, this error can arise due to a mismatch between the origin specified in the CORS configuration and the actual origin of the request. This mismatch can be caused by the fact that AWS Lambda functions are served through Amazon API Gateway, which can modify the request's origin. Furthermore, the CORS configuration in FastAPI might not be properly set up to handle preflight requests, leading to this error.

● Configuration & Code Resolution

To fix this issue, you need to configure the CORSMiddleware in your FastAPI application to allow all origins or specify the allowed origins explicitly. You can do this by adding the following code to your main.py file:
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware

app = FastAPI()

origins = [
    "*"
]

app.add_middleware(
    CORSMiddleware,
    allow_origins=origins,
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)
Alternatively, if you are using AWS API Gateway, you can configure the CORS settings in the API Gateway console by going to the 'Actions' dropdown, selecting 'Enable CORS', and then specifying the allowed origins.

Verification & Build Command

To verify that the CORS preflight origin mismatch error has been resolved, you can use a tool like curl to send a preflight request to your API endpoint and check the response headers. For example:
```
curl -X OPTIONS \
  http://your-api-endpoint.com/items/1 \
  -H 'Access-Control-Request-Method: GET' \
  -H 'Access-Control-Request-Headers: Content-Type' \
  -H 'Origin: http://your-frontend-origin.com'
```
If the response includes the Access-Control-Allow-Origin header with the value of the origin you specified, then the CORS configuration is correct and the error should be resolved.