Seems like using

$default

can screw up cors since it looks like it's routing options requests to it (which in my case fail because it requires auth)

Hey @thdxr, afaik

$default

doesn’t support http method, it’s a built-in catch all route

When I set

$default: "handler"

it applied my authorizer to OPTIONS cors requests

yeah i’ve seen that.. likely the expected behavior