Api CORS issue with 500 status after setup Cognito authorizer about serverless-application-model HOT 3 CLOSED

MyGatewayApi:
    Type: AWS::Serverless::Api
    Properties:
        ......
        AlwaysDeploy: true

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  MyCognitoUserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: MyUserPool

  MyCognitoUserPoolClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref MyCognitoUserPool
      ClientName: MyUserPoolClient

  MyGatewayApi:
    Type: AWS::Serverless::Api
    Properties:
      GatewayResponses:
        UNAUTHORIZED:
          StatusCode: 401
          ResponseParameters:
            Headers:
              Access-Control-Allow-Origin: "'*'"
        DEFAULT_4XX:
          ResponseParameters:
            Headers:
              Access-Control-Allow-Origin: "'*'"
        DEFAULT_5XX:
          ResponseParameters:
            Headers:
              Access-Control-Allow-Origin: "'*'"
      StageName: dev
      Cors: "'*'"
      AlwaysDeploy: true
      Auth:
        AddDefaultAuthorizerToCorsPreflight: false
        DefaultAuthorizer: CognitoAuthorizer
        Authorizers:
          CognitoAuthorizer:
            UserPoolArn: !GetAtt MyCognitoUserPool.Arn

  HelloWorldFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: hello_world_function
      Handler: hello_world/app.lambda_handler
      Runtime: python3.10
      Events:
        GetToken:
          Type: Api
          Properties:
            Path: /token
            Method: GET
            RestApiId: !Ref MyGatewayApi

# import requests
import json

def lambda_handler(event, context):
    return {
        'statusCode': 200,
        'body': json.dumps({
            'token': "11111"
        }),
        'headers': {
            'Access-Control-Allow-Origin': '*',
            'Access-Control-Allow-Headers': 'Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token',
            'Access-Control-Allow-Methods': '*',
            'Content-Type': 'application/json'
        }
    }