401 return from an API Gateway Custom Authorizer is missing 'Access-Control-Allow-Origin' header
<p>In order to prevent users who have not logged in to call my lambda function through the AWS API Gateway, I'm using the Custom Authorizer lambda solution.</p>

<p>If the request is authorized (200) and I get a response from the called lambda everything works fine and I get the <code>Access-Control-Allow-Origin</code> header.</p>

<p>But if the request is not authorized, I get a 401 that has no <code>Access-Control-Allow-Origin</code> header, therefore preventing me from reading the 401 status of the response and redirecting the user to the log-in page.</p>

<p>I believe this is because the Custom Autorization mechanism is unaware that the request needs to use CORS. Does anyone know that this is actually the issue? Are you aware of any possible solution?</p>