How to disable CORS in Azure Function App - azure

Question

I have a function app running on Linux (Consumption plan) with custom handler (GoLang). I have deliberately never enabled CORS, nor added any allowed origins. However OPTIONS requests are still being captured and handled and don't reach the application code. I need the OPTIONS requests to be handled by my application code. How can I disable Azure from capturing and handling those requests?
One more weird thing - if there is no Origin header present in the request, the request does actually reach my application code and respond with correct response and response headers (set by my app code). If however the Origin header is present in the request, the request never reaches the application code.
There seem to be some related issues, for instance:
https://github.com/Azure/azure-functions-host/issues/5200
Disable CORS middleware of Azure app service
https://social.msdn.microsoft.com/Forums/en-US/56ff3564-bb8c-4ff7-8920-90403cec38f6/how-to-disable-the-cors-policy-in-the-portal-overview
However none of the answers in these are particularly helpful.
How to prevent Azure from handling the CORS, if I've never enabled it in the first place?
Since this is a Linux app, there is very limited (virtually no) information available in Kudu, but here is my terraform code for the Linux Function:
resource "azurerm_service_plan" "ttAPIServicePlan" {
name = "tt-v2-${lower(var.ENV)}-service-plan-api"
os_type = "Linux"
sku_name = "Y1"
resource_group_name = azurerm_resource_group.ttResourceGroup.name
location = azurerm_resource_group.ttResourceGroup.location
}
resource "azurerm_linux_function_app" "ttAPIFunctionApp" {
name = "tt-v2-${lower(var.ENV)}-function-app-api"
resource_group_name = azurerm_resource_group.ttResourceGroup.name
location = azurerm_resource_group.ttResourceGroup.location
service_plan_id = azurerm_service_plan.ttAPIServicePlan.id
storage_account_name = azurerm_storage_account.ttAPIStorageAccount.name
storage_account_access_key = azurerm_storage_account.ttAPIStorageAccount.primary_access_key
site_config {}
app_settings = {
# Infrastructure variables
"FUNCTIONS_WORKER_RUNTIME" = "custom"
"APPINSIGHTS_INSTRUMENTATIONKEY" = azurerm_application_insights.ttAPIApplicationInsights.instrumentation_key
# Runtime variables
"ENV" = var.ENV
"JWT_SECRET" = var.JWT_SECRET
"AZURE_CREDENTIAL_TYPE" = var.AZURE_CREDENTIAL_TYPE
"CDN_BASE_URL" = var.CDN_BASE_URL
"CDN_ACCOUNT_URL" = var.CDN_ACCOUNT_URL
"CDN_CONTAINER_NAME" = var.CDN_CONTAINER_NAME
"MONGO_CONNECTION_URI" = var.MONGO_CONNECTION_URI
"MONGO_DATABASE" = var.MONGO_DATABASE
}
}
And here is my host.json file:
{
"version": "2.0",
"logging": {
"applicationInsights": {
"samplingSettings": {
"isEnabled": true,
"excludedTypes": "Request"
}
}
},
"extensionBundle": {
"id": "Microsoft.Azure.Functions.ExtensionBundle",
"version": "[4.0.0, 5.0.0)"
},
"extensions": {
"http": {
"routePrefix": "",
"customHeaders": {
"Access-Control-Expose-Headers": "*"
}
}
},
"customHandler": {
"enableForwardingHttpRequest": true,
"description": {
"defaultExecutablePath": "handler",
"arguments": []
}
}
}
And my function.json file:
{
"bindings": [{
"authLevel": "anonymous",
"type": "httpTrigger",
"direction": "in",
"name": "req",
"methods": [
"options",
"get",
"post",
"put",
"patch",
"delete"
],
"route": "{*route}"
}, {
"type": "http",
"direction": "out",
"name": "res"
}]
}