title: Pre-flight request returns 404 only on Chrome
body: <p>I am trying to access a resource on my website through Chrome, for which the browser performs a pre-flight OPTIONS request. This pre-flight request works fine in Firefox and even using cURL, but for some reason returns a 404 status in Chome. I am currently on Chrome v81.0.4044.129 on macOS version 10.15.4. See details below.</p>
  
  <p><strong>Console logs</strong></p>
  
  <pre><code>OPTIONS https://sub.my.website.com/v1/resource 404
  Access to XMLHttpRequest at 'https://sub.my.website.com/v1/resource' from origin 'https://my.website.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.​
  </code></pre>
  
  <p><strong>Request headers</strong></p>
  
  <pre><code>:authority: sub.my.website.com
  :method: OPTIONS
  :path: /v1/resource/
  :scheme: https
  accept: */*
  accept-encoding: gzip, deflate, br
  accept-language: en-GB,en-US;q=0.9,en;q=0.8,nl;q=0.7
  access-control-request-headers: authorization
  access-control-request-method: GET
  dnt: 1
  origin: https://my.website.com
  referer: https://my.website.com/v1/overview
  sec-fetch-dest: empty
  sec-fetch-mode: cors
  sec-fetch-site: same-site
  user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
  </code></pre>
  
  <p><strong>cURL request &amp; headers</strong></p>
  
  <pre><code>curl -i -X OPTIONS -H "Origin: https://my.website.com" \               
      -H 'Access-Control-Request-Method: GET' \
      -H 'Access-Control-Request-Headers: Authorization' \
      -H 'Referer: https://my.website.com/v1/overview' \
      -H 'Sec-Fetch-Mode: cors' \
      -H 'Sec-Fetch-Dest: empty' \
      -H 'Sec-Fetch-Site: same-site' \
      -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36' \
      -H 'DNT: 1' \
      -H 'Accept-Language: en-GB,en-US;q=0.9,en;q=0.8,nl;q=0.7' \
      -H 'Accept-Encoding: gzip, deflate, br' \
      -H 'Accept: */*' \
      "https://sub.my.website.com/v1/resource"
  </code></pre>
  
  <p><strong>​cURL​​ response</strong></p>
  
  <pre><code>HTTP/1.1 200 OK
  access-control-allow-origin: https://my.website.com
  access-control-allow-credentials: true
  access-control-allow-methods: POST,GET,PUT,DELETE,PATCH,OPTIONS,HEAD,CONNECT
  access-control-allow-headers: *
  access-control-max-age: 86400
  date: Thu, 30 Apr 2020 10:32:17 GMT
  server: istio-envoy
  content-length: 0
  </code></pre>
  
  <p>​Any help on this would be appreciated. Thanks!</p>