title: API Gateway, blocked by CORS policy: No 'Access-Control-Allow-Origin' header
body: <p>I know this question might be duplicated, but none of the existing question point to anything I'm not doing...</p>
  
  <p>I've deployed an API using the serverless framework, but I'm having trouble with CORS.</p>
  
  <p>I'm doing a get request using axios:</p>
  
  <pre><code>axios.get('https://test.execute-api.us-west-1.amazonaws.com/dev/test?from=2012-01-09T21:40:00Z')
       .then(response =&gt; {
         this.data = response.data;
       })
       .catch(error =&gt; console.log(error))
  </code></pre>
  
  <p>And I'm getting the following error:</p>
  
  <pre><code>Access to XMLHttpRequest at 'https://test.execute-api.us-west-1.amazonaws.com/dev/test?from=2012-01-09T21:40:00Z' from origin 'http://localhost:8080' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
  </code></pre>
  
  <p>What I've already done:</p>
  
  <ul>
  <li>Made sure there's an OPTIONS method in API Gateway with a method response that looks like this:</li>
  </ul>
  
  <p><a href="https://i.stack.imgur.com/mkjYB.png" rel="noreferrer"><img src="https://i.stack.imgur.com/mkjYB.png" alt="enter image description here"></a></p>
  
  <ul>
  <li>Made sure I deployed those changes.</li>
  </ul>
  
  <p>Also, the response of my Lambda function is returning the following headers:</p>
  
  <pre><code>return events.APIGatewayProxyResponse{
      StatusCode: http.StatusOK,
      Headers: map[string]string{
          "Access-Control-Allow-Origin":      "http://localhost:8080",
          "Access-Control-Allow-Credentials": "true",
      },
      Body: string(jsonEvents),
  }, nil
  </code></pre>
  
  <p>I also tried setting <code>Access-Control-Allow-Origin</code> to <code>'*'</code></p>
  
  <p>My serverless.yml file has <code>cors: true</code> on each of the function events:</p>
  
  <pre><code>functions:
    deploymentFrequency:
      handler: bin/update/deployment-frequency
      events:
        - http:
            path: deployment-frequency
            method: post
            cors: true
    fetchDeploymentFrequency:
      handler: bin/fetch/deployment-frequency
      events:
        - http:
            path: deployment-frequency
            method: get
            cors: true
  </code></pre>
  
  <p>What am I missing? Nothing seems to work. The request works fine from Postman and it looks to be including the headers, so this seems to be an issue with the OPTIONS method.</p>