403 -Forbidden, Cross-site POST form submissions are forbidden

[zamoshchin]

I'm attempting to call my Sveltekit endpoint /api/voice/answer_call from Twilio (this is a web hook that responds to Twilio's phone call) and am getting Cross-site POST form submissions are forbidden

How can I allow CORS?

I've added the following to my endpoint:

        headers: {
            'Content-Type': 'text/xml',
            "Access-Control-Allow-Origin": "*", // Allows all domains
            "Access-Control-Allow-Methods": "OPTIONS,POST,GET",
            "Access-Control-Allow-Headers": "Content-Type,Authorization",
            "Access-Control-Allow-Credentials": "true" // Only if your endpoint requires credentials
        },

I've also ensured CloudFront is not stripping these headers. I'm guessing the issue is with Lambda@Edge not forwarding these headers?

[yarbsemaj]

Hi @zamoshchin , thank you for your interest in my project! This seems to be a security feature built into svelte itself.

I believe this may be what your looking for

https://stackoverflow.com/a/73801539