title: AWS API Gateway CORS ok for OPTIONS, fail for POST
body: <p>I've looked at the other related questions on SO but this seems different.
  In fact, my question is very similar to <a href="https://stackoverflow.com/questions/38987256/aws-api-gateway-cors-post-not-working">this one</a>, except I don't have the 400 status issue.</p>
  
  <p>The set up:</p>
  
  <ul>
  <li>lambda function through API Gateway</li>
  <li>Authorization: None, API KEY Required: false</li>
  <li><p>deploying to stage: test</p></li>
  <li><p>1 resource, 1 POST method integrating the lambda.</p></li>
  <li>Calling the POST endpoint directly e.g. with curl always returns 200 (with/without payload, bad payload, etc.) - so that's different from the referenced question.</li>
  </ul>
  
  <p>I've used the "Enable CORS" option - I've tried applying this option on both the resource, and the POST request (and deploying the API afterwards).</p>
  
  <p>In API GW, I can see <code>Access-Control-Allow-Origin</code> listed in 200 Response Headers under POST method - Method Response area.</p>
  
  <p>Result: Calling the endpoint from client code in Chrome, OPTIONS passes but POST fails due to missing <code>Access-Control-Allow-Origin</code> header.</p>
  
  <p>In curl: OPTIONS call</p>
  
  <pre><code>curl -X OPTIONS -H "Access-Control-Request-Method: POST" \
       -H "Access-Control-Request-Headers: Content-Type" \
       -H "Origin: http://example.com" --verbose &lt;endpoint&gt;
  </code></pre>
  
  <p>the response is:</p>
  
  <pre><code>&lt; HTTP/1.1 200 OK
  &lt; Content-Type: application/json
  ...
  &lt; Access-Control-Allow-Headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
  &lt; Access-Control-Allow-Methods: POST,OPTIONS
  &lt; Access-Control-Allow-Origin: *
  ...
  </code></pre>
  
  <p>but with POST:</p>
  
  <pre><code>curl -X POST -d '{}' -H "Content-Type: application/json" \
       -H "Origin: http://example.com" --verbose &lt;endpoint&gt;
  </code></pre>
  
  <p>it returns:</p>
  
  <pre><code>&lt; HTTP/1.1 200 OK
  &lt; Content-Type: application/json
  ...
  </code></pre>
  
  <p>and the response json body - but no <code>Access-</code>anything header.</p>
  
  <p>What else can I check?</p>