Laravel REST API - CORS not applied in Production

This is my first project with Laravel and the development locally was smooth.

In production, my POST call works with a 200 response, but it does not send a preflight OPTIONS request. Even if I configure my cors.php to not allow the POST method or the origin, the POST continues to work.

I use Laravel 9 as a REST API and Angular 14 as frontend. Currently there is no authentication for the user. Locally CORS is working as it should. Sending preflight requests to my POST call and rejecting it in case it does not match my CORS config.

Deployment had to be done on web hosting with Apache. For Laravel to work I moved the index.php and .htaccess from /public to root and adapted the index.php to be able to access app.php, autoload.php and maintenance.php.

I changed the .htaccess to handle routing over the index.html from Angular and routing calls from /api over index.php.

index.php:

<?php

use Illuminate\Contracts\Http\Kernel;
use Illuminate\Http\Request;

define('LARAVEL_START', microtime(true));

if (file_exists($maintenance = __DIR__.'/storage/framework/maintenance.php')) {
    require $maintenance;
}

require __DIR__.'/vendor/autoload.php';

$app = require_once __DIR__.'/bootstrap/app.php';

$kernel = $app->make(Kernel::class);

$response = $kernel->handle(
    $request = Request::capture()
)->send();

$kernel->terminate($request, $response);

cors.php:

<?php

return [
    'paths' => ['api/*', 'sanctum/csrf-cookie'],

    'allowed_methods' => ['POST, OPTIONS'],

    'allowed_origins' => ['https:// example.com'],

    'allowed_origins_patterns' => [],

    'allowed_headers' => ['Origin, Content-Type, Accept'],

    'exposed_headers' => [],

    'max_age' => 0,

    'supports_credentials' => false,

];

.htaccess:

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    <IfModule mod_headers.c>
      Header set Access-Control-Allow-Origin "*" 
    </IfModule>
    
    RewriteEngine On

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
    
    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    RewriteRule api index.php [L]
    
    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.html [L]
</IfModule>

api.php:

...
Route::apiResource('mail', MailController::class);

kernel.php:

...
    protected $middleware = [
        \App\Http\Middleware\TrustProxies::class,
        \Illuminate\Http\Middleware\HandleCors::class,
        \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
        \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
        \App\Http\Middleware\TrimStrings::class,
        \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
    ];
...

Looks like CORS does not apply at all in production, which kind of scares me.