title: Blocked by CORS policy in Chrome after enabling CORS for Lambda Function?
body: <p>I've enabled CORS in the console for a Lambda function following <a href="https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-cors.html" rel="nofollow noreferrer">these instructions</a>.  </p>
  
  <p>The API is also an express server that enables CORS for all methods:</p>
  
  <pre><code>// Enable CORS for all methods
  app.use(function(req, res, next) {
    res.header("Access-Control-Allow-Origin", "*")
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept")
    next()
  });
  
  </code></pre>
  
  <p>However the browser is still blocking the request because it is not receiving the <code>Access-Control-Allow-Origin</code> header.  This is the complete message:</p>
  
  <blockquote>
    <p>home:1 Access to XMLHttpRequest at '<a href="https://szxjza7hz5.execute-api.us-east-1.amazonaws.com/loco/myendpoint" rel="nofollow noreferrer">https://szxjza7hz5.execute-api.us-east-1.amazonaws.com/loco/myendpoint</a>' from origin '<a href="http://localhost:4200" rel="nofollow noreferrer">http://localhost:4200</a>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.</p>
  </blockquote>
  
  <p>How do we trouble shoot this?</p>
  
  <p>The testing approach in the instructions provide a curl command like this:</p>
  
  <pre><code>curl -v -X OPTIONS -H "Access-Control-Request-Method: POST" -H "Origin: http://localhost:4200" https://szxjza7hz5.execute-api.us-east-1.amazonaws.com/loco
  </code></pre>
  
  <p>However this fails due to a missing authentication token:</p>
  
  <pre><code>* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
  &lt; HTTP/2 403 
  &lt; content-type: application/json
  &lt; content-length: 42
  &lt; date: Wed, 19 Feb 2020 01:45:47 GMT
  &lt; x-amzn-requestid: a529894d-19ff-4c95-915b-45c4098d30ea
  &lt; x-amzn-errortype: MissingAuthenticationTokenException
  &lt; x-amz-apigw-id: IHvz3Fp_IAMF43g=
  &lt; x-cache: Error from cloudfront
  &lt; via: 1.1 58e86c1faaee1b15c90e95d794e240dd.cloudfront.net (CloudFront)
  &lt; x-amz-cf-pop: ORD51-C3
  &lt; x-amz-cf-id: jyTAo6OUrhUWWVNOSdk6M0384K515YzE0V9Vgg-WhfXXkLDzLofr9Q==
  &lt; 
  * Connection #0 to host szxjza7hz5.execute-api.us-east-1.amazonaws.com left intact
  {"message":"Missing Authentication Token"}
  
  </code></pre>