Getting blocked by CORS policy but unable to figure out the source about cloudfront-authorization-at-edge

[kjpluck]

All sorted. Just spent a brain melting day setting up a CF distribution that requires signed urls. Thanks for your help!

[kjpluck]

Have also tried this on a dev server and getting same so localhost not a factor

[ottokruse]

Can you share an architecture diagram? And it would help to see the HAR file. If it is too sensitive to share here you can mail it to me at ottokrus at amazon nl

The user visits our app and gets redirected to Cognito to login and are redirected back on success. The app loads and starts making requests to CF like so:

https://zzzzzz.cloudfront.net/data/blahblah/foobar.json

CF redirects (307) the request to Cognito:
...

That's not right. After you signed in successfully you should have cookies with valid JWTs and then should no longer get 307s.

[kjpluck]

As the site is on a different domain to CF and Cognito this isn't possible which may well explain the CORS errors.

If there isn't a way around this then I will be exploring signed urls.

[ottokruse]

As the site is on a different domain to CF and Cognito this isn't possible which may well explain the CORS errors.

If there isn't a way around this then I will be exploring signed urls.

Aha two different domain names. Yes signed URLs is the way. Use an Cognito Identitity Pool to trade your JWTs for temporary AWS credentials with which you can create a signed URL. Amplify Storage makes this easy, does it automatically if you configure Amplify with an Identity Pool.