title: Resource blocked by CORS policy in Serverless API Gateway Lambda even though its set up
body: <p>I am using Serverless and I have a lambda that is available via API Gateway. Like many of the CORs questions that mention a similar stack, I am getting the following error when making a call from a browser (usual Postman/curl local testing works just fine):</p>
  <pre><code>Access to XMLHttpRequest at 'https://&lt;gatewayUrl&gt;/dev/login/?userType=userA' from origin 'http://localhost:3000' has been blocked by CORS policy: Request header field z-client-timezone is not allowed by Access-Control-Allow-Headers in preflight response
  </code></pre>
  <ul>
  <li><p>The Integration Request type is <code>Lambda_Proxy</code></p>
  </li>
  <li><p>Cors has been enabled, adding the Options Method</p>
  </li>
  <li><p>The lambda handler returns the expected headers</p>
  </li>
  <li><p>The axios request sends one custom header <code>Z-Client-Timezone</code> that is also allowed in the Lambda</p>
  </li>
  <li><p>I've tried everything including everything <a href="https://www.serverless.com/blog/cors-api-gateway-survival-guide" rel="nofollow noreferrer">here</a>, but no luck.</p>
  </li>
  </ul>
  <p>I'm extremely frustrated so any help would be awesome. One more thing, when I do <code>curl -i -X OPTIONS https://&lt;gatewayUrl&gt;/dev/login</code> I get this result, which seems to be missing <code>Z-Client-Timezone</code>:</p>
  <pre><code>HTTP/2 200
  content-type: application/json
  content-length: 0
  date: Fri, 10 Jul 2020 04:00:10 GMT
  x-amzn-requestid: &lt;aws_requestId&gt;
  access-control-allow-origin: *
  access-control-allow-headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
  x-amz-apigw-id: &lt;apigw-id&gt;
  access-control-allow-methods: OPTIONS,POST
  via: 1.1 &lt;id&gt;.cloudfront.net (CloudFront), 1.1 &lt;id&gt;.cloudfront.net (CloudFront)
  x-amz-cf-pop: DFW50-C1
  x-cache: Miss from cloudfront
  x-amz-cf-pop: DFW55-C1
  x-amz-cf-id: &lt;cf-id&gt;
  </code></pre>
  <p><strong>My Lambda:</strong></p>
  <pre><code>export async function login(event) {
  
      const headers = {
        'Content-Type': 'application/json',
        'Access-Control-Allow-Origin': '*',
        'Access-Control-Allow-Credentials': true
      }
  
      ....
      return {
        statusCode: 200,
        headers,
        body: JSON.stringify(session)
      };
  }
  </code></pre>
  <p><strong>My Serverless.yml:</strong></p>
  <pre><code>login:
    handler: dist/src/handlers/auth.login
    events:
      - http:
          path: login
          method: post
          cors: 
            origin: '*'
            headers:
             - Access-Control-Allow-Credentials
  
  resources:
    Resources:
      GatewayResponseDefault4XX:
          Type: 'AWS::ApiGateway::GatewayResponse'
          Properties:
              ResponseParameters:
                gatewayresponse.header.Access-Control-Allow-Origin: &quot;'*'&quot;
                gatewayresponse.header.Access-Control-Allow-Headers: &quot;'*'&quot;
              ResponseType: DEFAULT_4XX
              RestApiId:
                Ref: 'ApiGatewayRestApi'
  </code></pre>
  <p>I would love any help you can give. I've omitted some code as everything else works except for the cors stuff so I've just included that but if more clarification is needed, I'm happy to provide.</p>