AWS API Gateway CORS ok for OPTIONS, fail for POST
<p>I've looked at the other related questions on SO but this seems different.
In fact, my question is very similar to <a href="https://stackoverflow.com/questions/38987256/aws-api-gateway-cors-post-not-working">this one</a>, except I don't have the 400 status issue.</p>

<p>The set up:</p>

<ul>
<li>lambda function through API Gateway</li>
<li>Authorization: None, API KEY Required: false</li>
<li><p>deploying to stage: test</p></li>
<li><p>1 resource, 1 POST method integrating the lambda.</p></li>
<li>Calling the POST endpoint directly e.g. with curl always returns 200 (with/without payload, bad payload, etc.) - so that's different from the referenced question.</li>
</ul>

<p>I've used the "Enable CORS" option - I've tried applying this option on both the resource, and the POST request (and deploying the API afterwards).</p>

<p>In API GW, I can see <code>Access-Control-Allow-Origin</code> listed in 200 Response Headers under POST method - Method Response area.</p>

<p>Result: Calling the endpoint from client code in Chrome, OPTIONS passes but POST fails due to missing <code>Access-Control-Allow-Origin</code> header.</p>

<p>In curl: OPTIONS call</p>

<pre><code>curl -X OPTIONS -H "Access-Control-Request-Method: POST" \
     -H "Access-Control-Request-Headers: Content-Type" \
     -H "Origin: http://example.com" --verbose &lt;endpoint&gt;
</code></pre>

<p>the response is:</p>

<pre><code>&lt; HTTP/1.1 200 OK
&lt; Content-Type: application/json
...
&lt; Access-Control-Allow-Headers: Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
&lt; Access-Control-Allow-Methods: POST,OPTIONS
&lt; Access-Control-Allow-Origin: *
...
</code></pre>

<p>but with POST:</p>

<pre><code>curl -X POST -d '{}' -H "Content-Type: application/json" \
     -H "Origin: http://example.com" --verbose &lt;endpoint&gt;
</code></pre>

<p>it returns:</p>

<pre><code>&lt; HTTP/1.1 200 OK
&lt; Content-Type: application/json
...
</code></pre>

<p>and the response json body - but no <code>Access-</code>anything header.</p>

<p>What else can I check?</p>