title: Amplify: CORS header ‘Access-Control-Allow-Origin’ missing error even though CORS is enabled in API Gateway and Lambda headers
body: <p>I'm using Amplify, and have my API Gateway proxying to Lambda. I've enabled CORS on my <code>/{proxy+}</code> and deployed the API. In my Lambda function, I'm setting the appropriate header in my trivial function:</p>
  
  <pre class="lang-py prettyprint-override"><code>import json
  
  
  def handler(event, context):
      print("received event:")
      print(event)
      return {
          "statusCode": 200,
          "headers": {
              "Access-Control-Allow-Credentials": True,
              "Access-Control-Allow-Headers": "Content-Type",
              "Access-Control-Allow-Methods": "OPTIONS,POST,GET",
              "Access-Control-Allow-Origin": "*",
          },
          "body": json.dumps(event),
      }
  
  </code></pre>
  
  <p>This Lambda function sits behind an API Gateway resource which is authenticated via Cognito.</p>
  
  <p>When I invoke my API using Amplify: </p>
  
  <pre class="lang-js prettyprint-override"><code>let myInit = {
            headers: {
              Authorization: `Bearer ${(await Auth.currentSession())
                .getIdToken()
                .getJwtToken()}`
            }
          }; 
  
  API.get("adminapi", "/admin", myInit) ...
  
  </code></pre>
  
  <p>I get the dreaded CORS header 'Access-Control-Allow-Origin' missing from my <code>GET</code> request:</p>
  
  <p><code>Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://xxxxxxxxxx.execute-api.us-east-1.amazonaws.com/dev/admin. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).</code></p>
  
  <p>I see it returned in the <code>OPTIONS</code> request:</p>
  
  <p><a href="https://i.stack.imgur.com/WtmYm.png" rel="noreferrer"><img src="https://i.stack.imgur.com/WtmYm.png" alt="enter image description here"></a></p>
  
  <p>I even tested in Postman to verify the headers are coming back:</p>
  
  <p><a href="https://i.stack.imgur.com/BeU1D.png" rel="noreferrer"><img src="https://i.stack.imgur.com/BeU1D.png" alt="enter image description here"></a></p>
  
  <p>What am I doing wrong here? It doesn't look like the call is getting past API Gateway. I wonder if it has to do with authentication. When I test from Postman using my IAM credentials it works fine, but from my web app using the bearer token it fails as above.</p>