RewriteResponseHeader is not rewriting response header for a preflight CORS request

Describe the bug
I would like to rewrite any response header from
Access-Control-Allow-Origin: null to Access-Control-Allow-Origin: *

RewriteResponseHeader is not rewriting response header Access-Control-Allow-Origin: null for a CORS preflight request when the preflight request header contains Access-Control-Request-Method and Origin. Disabling other headers will not affect the result.

For other restful request (GET, POST etc), the RewriteResponseHeader will rewrite the response header Access-Control-Allow-Origin: null to Access-Control-Allow-Origin: *

Other Observation
I observed that the gateway will auto-fill response header Access-Control-Allow-Origin with value of request header Origin.

I am not sure why this is the behavior but it cause some security issue when request is with Origin: null.
Therefore I would like to rewrite the response header Access-Control-Allow-Origin: null to Access-Control-Allow-Origin: *

Other Alternatives Tried
I tried to set SetResponseHeader=Access-Control-Allow-Origin, *, but still the response header is not rewritten for a preflight request header containing Access-Control-Request-Method and Origin

Sample
I have below setting in application.yml

An preflight request that gateway failed to rewrite the response header

If we omit Access-Control-Request-Method in preflight, the response header will be rewritten

Non-preflight request that gateway successfully rewrite the response header

Start with the RewriteResponseHeader component and trace how preflight requests containing Access-Control-Request-Method and Origin are handled. Compare that path with the successful GET or POST behavior and verify the result using the request variations and application.yml configuration described in the issue. Done means Access-Control-Allow-Origin: null is rewritten as requested for preflight responses without breaking other requests.