Closed spainala closed 3 years ago
After further research setting the host header in the API request is not allowed per the HTTP Spec. https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name
I had tested adding the custom host header to the server.js file but it was ignored by the browser and rewritten to be the target domain of the API request.
This ticket can be closed, work around is to use a Reverse Proxy to add the Private API Gateway domain to the Host Header.
Please consider adding an Optional field in the web interface for configurations deployed in a VPC. A new "Host" field for the "API Endpoint Connection" configuration would allow an operator to enter an endpoint that would append the server.js file. The "Host" entry will append the msam\js\app\server.js file providing a change to the header used for API calls. This change will prevent the current need for a reverse proxy.
Operating MSAM in a VPC requires the API Gateway endpoint type is Private. Currently, the API Gateway endpoint type is Edge.