I have a HTTP API set up in serverless

betaEmailApi:
    name: beta-email-api
    handler: dist/betaEmail.handler
    events:
      - http:
          path: /v1.0/betaEmail
          method: post
          cors: true

Within the API I'm returning the required headers

{
     headers: {
         'Access-Control-Allow-Origin': '*',
     },
}

For a small subset of users - the Access-Control-Allow-Origin header is present on the OPTIONS response but not the preceding POST.

I've added to a gist here the HAR file snippet - where it shows it correctly getting a response of Access-Control-Allow-Origin for OPTIONS but not POST https://gist.github.com/jake-owen-p/7a47d03d65e969c9e2b694d827f267c3

Access-Control-Allow-Origin not being there is causing cors errors - as its only for a small subset of users I'm unsure

Side Questions

• The connection number is not persisting between the OPTIONS and POST - could that be causing the issue?
• I've seen it work for HTTP2 - can HTTP1 be the problem?