I'm troubleshooting a CORS issue and am currently analyzing the preflight headers.

I'm using an "HTTP" API in aws apigateway (different from what apigateway calls a "REST" api) to connect to a lambda function using the "lambda function" apigateway integration type.

It seems that no matter what I set in the CORS menu for HTTP apis, the preflight Response just doesn't have the headers I think I've enabled.

In the image below from devtools network tab, it's clear that apigateway is responding (hence the apigw-requestid). However, I would expect the Access-Control-Allow-Origin header to be returned too. No such luck.

My $default stage is set to autodeploy.

I have a proper route and integration attached to the lambda, along with the proper http verb (POST in my case).

There's no authorization set.

I've tried returning the proper headers in my lambda itself, but as the aws documentation says, apigateway ignores them and writes its own stuff. (the lambda wasn't even contacted unless I added an OPTIONS route .. which seems unnecessary anyway)

Yes, there are many such questions here, but most direct you to apigateway "REST" apis, not "HTTP."