title: AWS API Gateway - CORS with specific domain
body: <p>I have a Lambda function integrated with API Gateway with CORS enabled. I'm using the LAMBDA_PROXY integration, so I know I must specify the <code>Access-Control-Allow-Origin</code> header in my response in the Lambda function. However, I only want to allow cross resource sharing from a specific domain (www.example.com). </p>
  
  <p>Lambda Function - </p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>'use strict'
  module.exports.handler = (event, context, callback) =&gt; {
    const response = {
      statusCode: 200,
      headers: {
        "Access-Control-Allow-Origin": "https://www.example.com"
      },
      body: JSON.stringify({
        message: 'Go Serverless v1.0! Your function executed successfully!'
      }),
    };
  
    callback(null, response);
  };</code></pre>
  </div>
  </div>
  </p>
  
  <p>When I perform a test GET request (from the API Gateway console) it returns a successful (200) response. I would expect because I'm invoking the endpoint from the AWS Api Gateway console and not from <a href="https://www.example.com" rel="nofollow noreferrer">https://www.example.com</a> the endpoint should have returned a non-200 status code.</p>
  
  <p>I can see the <code>Access-Control-Allow-Origin</code> header in my response - 
  <a href="https://i.stack.imgur.com/uc9zx.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/uc9zx.png" alt="enter image description here"></a></p>
  
  <p>Why am I getting a 200 status code if my origin domain is not <a href="https://www.example.com" rel="nofollow noreferrer">https://www.example.com</a>?? </p>
  
  <p>Also, I've tried making an Ajax call from a website statically hosted website in S3. I'm still getting the 200 response and the JSON data even though I'm clearly not making the call from www.example.com.</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>I ended up recreating the resources just to add a live example to this question.</p>
  
  <p>When I click on the API endpoint directly, it allows me to get the JSON data back (I'm using Google Chrome 64.0.3282.186 and FireFox 58.0.2).</p>
  
  <p><a href="https://w69y8dk663.execute-api.us-east-1.amazonaws.com/dev/api/status" rel="nofollow noreferrer">https://w69y8dk663.execute-api.us-east-1.amazonaws.com/dev/api/status</a></p>
  
  <p>However, when I make an Ajax request from a statically hosted s3 website, I get the error.</p>
  
  <p><a href="http://test-cors-ajax.s3-website-us-east-1.amazonaws.com/" rel="nofollow noreferrer">http://test-cors-ajax.s3-website-us-east-1.amazonaws.com/</a></p>
  
  <p>I tested the ajax yesterday and it was letting me get the JSON data back, something must have been getting cached somewhere (running old code that didn't have the allow-access-origin header). Anyways, it looks like it's functioning as expected. </p>
  
  <p>I do find it interesting that my browser let's me directly hit the endpoint without throwing the CORS error. Thank you for your input.</p>