Send Allow-Origin header for all methods when cors is enabled

Author: mcattarinussi

index.js

@@ -93,7 +93,8 @@ module.exports = function(options) {
         callbacks.push(executeLambdaCallback(func));
         // Setup endpoint
         if (e.cors) {
-          httpConfig.eventHandler('options', path, [decorateAddCORSCallback(), send200]);
+          httpConfig.eventHandler('options', path, [decorateAddCORSCallback(true), send200]);
+          callbacks.unshift(decorateAddCORSCallback());
         }
         httpConfig.eventHandler(method, path, callbacks);
       }

lib/decorators-callbacks.js

@@ -18,11 +18,13 @@ module.exports.decorateLambdaReqCallback = function(getPrincipalId) {
   };
 };
 
-module.exports.decorateAddCORSCallback = function() {
+module.exports.decorateAddCORSCallback = function(isOptionMethod) {
   return function(req, res, next) {
+    if(isOptionMethod) {
+      res.header('Access-Control-Allow-Methods', 'GET,PUT,HEAD,PATCH,POST,DELETE,OPTIONS');
+      res.header('Access-Control-Allow-Headers', 'Authorization,Content-Type,x-amz-date,x-amz-security-token');
+    }
     res.header('Access-Control-Allow-Origin', '*');
-    res.header('Access-Control-Allow-Methods', 'GET,PUT,HEAD,PATCH,POST,DELETE,OPTIONS');
-    res.header('Access-Control-Allow-Headers', 'Authorization,Content-Type,x-amz-date,x-amz-security-token');
     next();
   };
 };