title: Can't use custom Request Headers on AWS API Gateway with CORS
body: <p>I have created and deployed an AWS API Gateway resource with the following structure including a custom HTTP Request Header 'X-header'</p>
  
  <pre><code>dev (stage)
    /echo (resource)
      POST (method)
        Method Request - Headers: X-header
      OPTIONS (method)
        Method Request - Headers: X-header
  </code></pre>
  
  <p>When I POST to the endpoint from Chrome, I get the following error.</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="https://fxxxx.execute-api.us-west-2.amazonaws.com/dev/echo" rel="noreferrer">https://fxxxx.execute-api.us-west-2.amazonaws.com/dev/echo</a>. Request header field X-header is not allowed by Access-Control-Allow-Headers in preflight response.</p>
  </blockquote>
  
  <p>Chrome is doing a preflight check against the OPTIONS method. I can see the Request Headers:</p>
  
  <blockquote>
    <p>Access-Control-Request-Headers:accept, content-type, x-header<br>
    Access-Control-Request-Method:POST</p>
  </blockquote>
  
  <p>But the Response Headers only have:</p>
  
  <blockquote>
    <p>Access-Control-Allow-Headers:Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token<br>
    Access-Control-Allow-Methods:POST,OPTIONS<br>
    Access-Control-Allow-Origin:*</p>
  </blockquote>
  
  <p>Chrome expects the Response Access-Control-Request-Headers to include my custom x-header, which seems logical. Is this an API Gateway bug? </p>
  
  <p>The only workaround I see is to remove the custom header and pass the data in the POST body.</p>