I'm running a local AWS-style stack with Docker Compose and Terraform, including a REST API Gateway and Lambda handler. The API works from Postman, but browser requests fail during the CORS preflight with: "Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource."
I've set DISABLE_CORS_CHECKS=1 and tried configuring explicit OPTIONS methods for both the root path and a greedy {proxy+} path, routing those requests to the Lambda through proxy integrations. The deployment succeeds, but the browser still rejects the response. Since Postman does not enforce browser CORS rules, I'm unsure whether the problem is the emulator's API Gateway behavior, the OPTIONS integration, or the Lambda response. What should I check or change?
2 Answers
The wildcard origin is only suitable when credentials are not being sent. If the frontend uses cookies or an authorization flow that requires credentials, return the specific requesting origin instead of `*`, and include `Access-Control-Allow-Credentials: true`. For initial testing, try a request without credentials and allow `*`; if that works, replace it with an origin allowlist. Also verify that the requested headers and methods are listed in the preflight response.
Postman working doesn’t confirm that CORS is configured—Postman doesn’t enforce browser-origin rules. The preflight response itself must include headers such as `Access-Control-Allow-Origin`, `Access-Control-Allow-Methods`, and `Access-Control-Allow-Headers`. With a Lambda proxy integration, API Gateway generally won’t add those headers for you; the Lambda must return them, including for the `OPTIONS` request. Also make sure the normal GET/POST responses include `Access-Control-Allow-Origin`, not just the preflight response. `DISABLE_CORS_CHECKS` in a local emulator may not configure browser-facing response headers.
An explicit OPTIONS route alone won’t help if the Lambda response has no CORS headers. Check the browser’s Network tab and inspect the actual OPTIONS response status and headers.
Adding an OPTIONS method is the right general idea, but it still has to return a successful response with the required CORS headers. The same headers are needed on error responses too, otherwise the browser can report a CORS failure instead of showing the underlying Lambda error.