# This is a ...

[x] bug report
[ ] feature request

# Detailed description

When running an `serverless-express` API in a lambda pushed to localstack in Docker, OPTIONS requests from a client with the `withCredentials` flag fail because of the wildcard `'*'` in `Access-Control-Allow-Origin` header returned by calling the endpoint (e.g.: `http://localhost:4566/restapis/<id>/<stage>/_user_request_/api/`). The request doesn't reach the lambda at all.

docker-compose.yml:
```yml

services:
  localstack:
    container_name: "${LOCALSTACK_DOCKER_NAME-localstack_main}"
    image: localstack/localstack:latest
    network_mode: bridge
    ports:
      - "4566:4566"
      - "4571:4571"
    environment:
      - DEFAULT_REGION=us-east-1
      - SERVICES=iam,lambda,apigateway,s3,ses,sts,sns,cloudformation,cloudwatch
      - DEBUG=1
      - DATA_DIR=/tmp/localstack/data
      - LAMBDA_EXECUTOR=docker-reuse
      - LAMBDA_REMOTE_DOCKER=0
      - KINESIS_ERROR_PROBABILITY=${KINESIS_ERROR_PROBABILITY- }
      - DOCKER_HOST=unix:///var/run/docker.sock
      - HOST_TMP_FOLDER=${PWD}/.localstack
      - LAMBDA_DOCKER_NETWORK=bridge
    volumes:
      - "${PWD}/.localstack:/tmp/localstack"
      - "/var/run/docker.sock:/var/run/docker.sock"

```

## Expected behavior

Allow defining a single(?) allowed origin for the header so that the preflight request doesn't fail.

## Actual behavior

Browser errors out with: 

```
Access to XMLHttpRequest at '<endpoint>' from origin 'http://localhost:8080' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.
```

# Steps to reproduce

- Create a simple API based on `serverless-express` with `express-session` as session handler.
- Use `withCredentials` flag to send requests to the API via `axios` or similar

## Command used to start LocalStack

`docker-compose up`

## Client code (AWS SDK code snippet, or sequence of "awslocal" commands)


'x-amz-content-sha256', 'x-amz-date', 'x-amz-security-token', 'x-amz-user-agent',
    'x-amz-target', 'x-amz-acl', 'x-amz-version-id', 'x-localstack-target', 'x-amz-tagging']
if EXTRA_CORS_ALLOWED_HEADERS:
    CORS_ALLOWED_HEADERS += EXTRA_CORS_ALLOWED_HEADERS.split(',')
CORS_ALLOWED_METHODS = ('HEAD', 'GET', 'PUT', 'POST', 'DELETE', 'OPTIONS', 'PATCH')
CORS_EXPOSE_HEADERS = ('x-amz-version-id', )
if EXTRA_CORS_EXPOSE_HEADERS:
    CORS_EXPOSE_HEADERS += tuple(EXTRA_CORS_EXPOSE_HEADERS.split(','))
ALLOWED_CORS_RESPONSE_HEADERS = ['Access-Control-Allow-Origin', 'Access-Control-Allow-Methods',
    'Access-Control-Allow-Headers', 'Access-Control-Max-Age', 'Access-Control-Allow-Credentials',
    'Access-Control-Expose-Headers']
class ProxyListener(object):
    
    DEFAULT_LISTENERS = []
    def forward_request(self, method, path, data, headers):
        """ This interceptor method is called by the proxy when receiving a new request
            (*before* forwarding the request to the backend service). It receives details
            of the incoming request, and returns either of the following results:
            * True if the request should be forwarded to the backend service as-is (default).
            * An integer (e.g., 200) status code to return directly to the client without
              calling the backend service.
            * An instance of requests.models.Response to return directly to the client without
              calling the backend service.
            * An instance of requests.models.Request which represents a new/modified request
              that will be forwarded to the backend service.
            * Any other value, in which case a 503 Bad Gateway is returned to the client
              without calling the backend service.
        """
        return True
    def return_response(self, method, path, data, headers, response, request_handler=None):