I am having a frontend (angular) application calling a backend API hosted on AWS cloud. I am using Okta and federated auth with Azure AD. The API call routes through AWS API gateway with a custom lambda authorizer (custom node image) to the backend API.

Cloudfront –> API gateway –> Lambda Authorizer –> Okta

My custom authorizer abstracts my IDP for the calling applications and so handles all Okta calls.

But when trying to logout from my client application I am getting CORS issue .
My flow for logout is (application logout –> API gateway custom authorizer –> call Okta /revoke –> returns redirect URL postlogout URL .

Error :
Access to XMLHttpRequest at 'https://xxx.oktapreview.com/oauth2/default/v1/logout?id_token_hint=xxxNCAQ&post_logout_redirect_uri=https://test.mydomain.com/hat/account/login&state=3xxxx2df' (redirected from 'https://test.mydomain.com/app/oauth2/logout') from origin 'hhttps://test.mydomain.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Code :
const sessionLogout = async (event) => {
 :
  let post_logout_redirect_uri = params.get("post_logout_redirect_uri")
    ? params.get("post_logout_redirect_uri")
    : getPostLogoutRedirectUrl();

  let state = params.get("state") ? params.get("state") : generateStateValue();

  try {

      // Revoke the access token
      let revokeTokenStatus = await revokeAccessToken(access_token);
:
      // Create logout URL for redirection
      const logoutUrl = `https://${getOauthHost()}${getOauthLogoutPath()}?id_token_hint=${id_token}&post_logout_redirect_uri=${post_logout_redirect_uri}&state=${state}`;
      return createResponse(logoutUrl, 302, event.headers.Host); //Redirect
 :
  } catch (error) {
 : error: ${error}`);

    return {
      statusCode: 500,
      body: JSON.stringify({ message: "Logout failed" }),
    };
  }
};

API Gateway :

MyResource
  /
    - /myprod
        -/logout
          POST  (access token + id token)   

Flow

Client --> /logout (POST access_token , id_token) --> AWS API Gateway --> Custom Authorizer Lambda --> Okta (/revoke)  

If Okta (/revoke) is 200 OK --> createResponse with postLogout URl (application logout ) and Okta logout [https://xxx.oktapreview.com/oauth2/default/v1/logout?id_token_hint=xxxNCAQ&post_logout_redirect_uri=https://test.mydomain.com/hat/account/login&state=3xxxx2df] --> send back to Client (Angular)

Angular redirect fails for CORS error.

Tried Enable CORS for resource and allow-header to * but did not help. Any pointers would be helpful.

Thanks