We have a REST API implemented with an AWS Lambda Function in JavaScript, and we need to address the Often Misused: HTTP Method Override vulnerability, this is, verb tunneling is possible through the headers X-Http-Method X-Http-Method-Override X-Method-Override and we want to avoid this by filtering/removing/blocking these headers.

We don't have the possibility to filter these headers in AWS API Gateway, so we should do that from the Lambda function when we get the request.

I share some code for context. This is how we get the request:

index.js

module.exports.handler = async event => {
...
    if (event.httpMethod === 'OPTIONS') {
        return {
            statusCode: 200,
            headers: corsHeaders
        };
    }
...
}