CORS pre-flight OPTIONS not working because of lowercase casting

Hi all,

I just picked up lambda-api, and seems like its the perfect solution for my project; however, I have been struggling for hours trying to get CORS to work.

My OPTIONS pre-flight request headers are being properly sent, but they're all lower case, and it's causing my web appl running in Google Chrome to not recognize it as Access-Control-Allow-Origin as this is the error I am receiving from it:

Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

I verified, with postman, that this is the headers coming back from the pre-flight OPTIONS request:

However, noticed that they're all lower case, and thus Google Chrome cannot find Access-Control-Allow-Origin

This is how it's getting received in Google Chrome:

This is how I am providing CORS in my Lambda:

// import AWS Lambda types
import { APIGatewayProxyEventV2, Context } from "aws-lambda";
// import Lambda API default function
import createAPI from "lambda-api";
import { Authorizer, Role } from "./authorizer";
import { ListProducts } from "./products/List";

// instantiate framework
const api = createAPI({});

// ************************************* CORS *************************************
api.options("/*", (req: any, res: any) => {
  // Add CORS headers
  res.header("Access-Control-Allow-Origin", "*");
  res.header("Access-Control-Allow-Methods", "*");
  res.header("Access-Control-Allow-Headers", "Content-Type, Authorization, Content-Length, X-Requested-With");
  res.sendStatus(200);
});

Please suggest a workaround for current version of Chrome.

Thank you!

Start by reproducing the OPTIONS request using the provided api.options("/*", ...) route and inspect how lambda-api returns the configured CORS headers. Trace the response-header handling responsible for lowercase casting, then verify the corrected pre-flight response in Chrome and with Postman.