Motivation

This was supposed to be a hackathon project that I forgot to present. This is related to #11587 and #11577.
We can make use of the specs to automatically expose headers as given by the specs for a specific operation, instead of adding them one by one.

This also adds a small fix related to the Allow-Headers, as we were trying to access the response headers instead of the request header. I'm not too sure of the existing behavior here to be honest, as it effectively always adds the headers, so the existing list is not really needed.

We could maybe also always use * for Expose headers (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers), as I'm not sure we have a lot of security issues regarding this, and it might just be way lighter than accessing the specs.

In any case, this additional logic is only executed when the request has a Origin header, so when it's coming from a browser, so it shouldn't impact performance in other cases.

The problem with testing is that not many service operations actually return headers, there is the Lambda case in case of exception, but for this you need to actually call lambda.Invoke and get an execution failure, which isn't too adapted to the test_security.py file...

\cc @dfangl @webdev51

Changes

• add a new method in the CORS enricher to automatically adds the possible headers from an AWS API operation to the Expose CORS headers
• fix the allowed headers to get all the headers from the request