HTTP Trigger Overview

Trigger limits

• At most one HTTP trigger per function version or alias. See Version management and Alias management.

• Built-in domain names are for testing only — stability is not guaranteed. Do not use them for production-facing services. For public-facing services, bind an ICP-filed custom domain name before exposing your function. See Configure a custom domain name.

Request limits

Exceeding the header, path, or body limits for synchronous invocations returns HTTP status code 400 with error code InvalidArgument.

Unsupported request headers: any header starting with x-fc-, plus connection and keep-alive.

Response limits

Exceeding the response header limit returns HTTP status code 502 with error code BadResponse.

Unsupported response headers: any header starting with x-fc-, plus connection, content-length, date, keep-alive, server, upgrade, and content-disposition:attachment.

Synchronous invocation

HTTP triggers use synchronous invocation by default. The function processes the request and returns the result before the connection closes. See Synchronous invocation.

Asynchronous invocation

In asynchronous invocation, Function Compute persists the request and immediately returns HTTP status code 202, without waiting for the function to finish. Any status code other than 202 means the invocation failed. See Retry mechanism for failure handling.

Two ways to invoke asynchronously:

• Request-level async: Add the header "X-Fc-Invocation-Type": "Async" to any HTTP request. See Asynchronous invocation.

• Asynchronous task: After configuring an asynchronous task for your function, add the header "X-Fc-Async-Task-Id": "<task-id>" to specify the invocation ID. See Asynchronous task.

The response includes the request ID in the header, for example: "X-Fc-Request-Id": "80bf7****281713e1". For all supported request headers, see Invoke a function.

Default CORS behavior

By default, Function Compute echoes back CORS headers based on the request. For simple requests (no preflight), the response includes:

• Access-Control-Allow-Origin: copied from the request Origin header

• Access-Control-Allow-Credentials: true

• Access-Control-Expose-Headers: headers defined by Function Compute

Handle CORS in function code

For simple requests, set Access-Control-Allow-* headers directly in your response.

For non-simple requests, a browser sends a preflight OPTIONS request before the actual request. Add OPTIONS to your HTTP trigger's allowed methods and handle it in your function code.

<details> <summary>Node.js example</summary>

exports.handler = (event, context, callback) => {
  const method = JSON.parse(event).requestContext.http.method;
  if (method === 'OPTIONS') {
    const fcResponse = {
      statusCode: 204,
      headers: {
        'Access-Control-Allow-Origin': 'http://www.fc.com',
        'Access-Control-Allow-Methods': 'POST',
        'Access-Control-Allow-Headers': 'Content-Type, Authorization',
        'Access-Control-Max-Age': '3600'
      },
      body: ''
    };
    callback(null, fcResponse);
  } else {
    callback(null, {
      statusCode: 200,
      body: 'hello world'
    });
  }
};

</details>

<details> <summary>Python example</summary>

import json

def handler(event, context):
    evt = json.loads(event)
    method = evt.get('requestContext', {}).get('http', {}).get('method', '')
    if method == 'OPTIONS':
        return {
            'statusCode': 204,
            'headers': {
                'Access-Control-Allow-Origin': 'http://www.fc.com',
                'Access-Control-Allow-Methods': 'POST',
                'Access-Control-Allow-Headers': 'Content-Type, Authorization',
                'Access-Control-Max-Age': '3600'
            },
            'body': ''
        }
    return {
        'statusCode': 200,
        'body': 'hello world'
    }

</details>

<details> <summary>Go example</summary>

package main

import (
    "context"
    "encoding/json"
)

type HttpRequest struct {
    RequestContext struct {
        Http struct {
            Method string `json:"method"`
        } `json:"http"`
    } `json:"requestContext"`
}

type HttpResponse struct {
    StatusCode int               `json:"statusCode"`
    Headers    map[string]string `json:"headers"`
    Body       string            `json:"body"`
}

func Handler(ctx context.Context, event []byte) (*HttpResponse, error) {
    var req HttpRequest
    if err := json.Unmarshal(event, &req); err != nil {
        return nil, err
    }
    if req.RequestContext.Http.Method == "OPTIONS" {
        return &HttpResponse{
            StatusCode: 204,
            Headers: map[string]string{
                "Access-Control-Allow-Origin":  "http://www.fc.com",
                "Access-Control-Allow-Methods": "POST",
                "Access-Control-Allow-Headers": "Content-Type, Authorization",
                "Access-Control-Max-Age":       "3600",
            },
            Body: "",
        }, nil
    }
    return &HttpResponse{StatusCode: 200, Body: "hello world"}, nil
}

</details>

API Configured CORS

API Configured CORS is available as an invitational preview. To enable it, contact us and provide your Alibaba Cloud account ID (UID).

API Configured CORS is a gateway-layer feature. Configure CORS policies directly on an HTTP trigger or custom domain name — no CORS logic needed in your function code.

Key benefits:

• No code changes: Decouple CORS handling from business logic.

• Lower cost: The gateway handles preflight OPTIONS requests directly, so no function instance runs.

• Centralized management: Apply CORS policies at the trigger or domain level.

• Lower latency: The gateway returns preflight responses without invoking your function.

Scope:

• FC 3.0 functions only (API version 2023-03-30)

• Applies to HTTP triggers (including built-in test domains) and bound custom domain names

Configure using the Update trigger or Update custom domain name API.