Lambda function url receives CORS failure from static frontend

I have a lambda function url configured as https://xxxx.lambda-url.us-east-1.on.aws/ that I am able to access via postman/curl with a successful response, but I get the following error when attempting to use an XHR request from a JavaScript frontend on a static site (hosted with Netlify).

> Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://xxxx.lambda-url.us-east-1.on.aws/. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.

> Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://xxxx.lambda-url.us-east-1.on.aws/. (Reason: CORS request did not succeed). Status code: (null).

I have configured the lambda's function url as follows via terraform:

resource "aws_lambda_function_url" "contact-mailer-endpoint" {
    function_name = aws_lambda_function.lambda_ses_fn.function_name
    authorization_type = "NONE"

    cors {
        allow_credentials   = true
        allow_methods       = ["*"]
        allow_origins       = ["*"]
        allow_headers       = ["date", "keep-alive", "X-Requested-With", "Access-Control-Allow-Origin", "Origin"]
        expose_headers      = ["date", "keep-alive", "X-Requested-With", "Access-Control-Allow-Origin", "Origin"]
        max_age             = 0
    }
}

And I am hitting the endpoint via the following javascript code:

let xhr = new XMLHttpRequest()

            xhr.onreadystatechange = () => {
                if (xhr.readyState === 4){
                    if (xhr.status === 200){
                        ...
                    }
                    else {
                        ...
                    }
                }
            }
            xhr.open('POST', 'https://xxxx.lambda-url.us-east-1.on.aws/')
            xhr.setRequestHeader('Content-Type', 'application/json');
            xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
            xhr.setRequestHeader('Access-Control-Allow-Origin', '*');
            xhr.setRequestHeader('Origin', 'https://site-i-am-currently-on.com'); //contains actual website url
            xhr.send(body)

I believe I am adding some unneccesary data on the frontend, but it seems as though my cors policy is appropriate according to the console with the wildcard (*) operator on "Allow origin". Is there a reason this provides a CORS error?

To resolve the CORS issue,

You can either remove the following Content-Type header configuration code from the XMLHTTPRequest. If you remove it, the lambda will use application/json as a default content type.

// xhr.setRequestHeader('Content-Type', 'application/json');

OR

Configure your lambda function to accept the content-type header on API requests.