Kong: the cors plugin answers preflight requests for you

curl -X POST http://localhost:8001/routes/api/plugins \
  --data name=cors \
  --data 'config.origins[]=https://app.example.com' \
  --data 'config.methods[]=GET' --data 'config.methods[]=POST' \
  --data 'config.headers[]=Authorization' \
  --data config.credentials=true \
  --data config.max_age=3600

curl -i -X OPTIONS http://localhost:8000/api \
  -H 'Origin: https://app.example.com' \
  -H 'Access-Control-Request-Method: POST'

HTTP/1.1 200 OK
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 3600

# Remove @CrossOrigin and any CORS filter from the upstream. If both send
# the header the browser sees two values and rejects the response outright.