This is a Bug Report

Description

I have configured a function with an 'http' POST event, CORS enabled. When I return status codes other than 200 (using the '[NNN] Message...' format), the response is missing the Access-Control-Allow-Origin header.

This is causing the browser CORS check to fail and throw a network error, rather than pass the actual status code and response through to the client.

According to the CORS spec, all responses should include the Access-Control-Allow-Origin header, not just a 200 response.

To Reproduce

Configure a function as follows:

corsTest:
  handler: handler.corsTest
  events:
    - http:
        path: cors-test
        method: post
        cors: true

In the handler:

module.exports.corsTest = ( event, context, cb ) => {
  cb( '[401] Please log in', null );
}

In the client:

fetch( 'https://[endpoint]/cors-test', { method: 'POST' } )
  .then( response => console.log(response) );

The outcome will be a browser-specific CORS failure, rather than a logged response object containing the status code and message.