S3 upload from browser with presigned URL and SSE-C - 307 and 403s

Here's my scenario:

• using a server to generate presigned URLs that are sent down to the browser on-demand. The browser uploads files to these URLs and then sends the results of the uploads to the server (to avoid making those files cross our load balancers etc.). I keep getting 307s and CORS failures

• the files are encrypted using SSE-C and placed in a bucket that has a private ACL. The signed urls are generated w/ the first snipped and utilized with the second

Server

const params = {
        Bucket: bucket,
        Key: objectKey,
        Expires: expiration,
        SSECustomerAlgorithm: 'AES256',
        SSECustomerKey: ssecKey,
        SSECustomerKeyMD5: ssecMD5,
        Metadata: { filename, userId }
    };
    return S3Module.S3.getSignedUrl('putObject', params);

Client

    // ...
    uploadToS3(url, file, params) {
            return new Promise((resolve, reject) => {
                const customHeaders = {
                    'x-amz-meta-filename': params['x-amz-meta-filename'],
                    'x-amz-meta-userId': params['x-amz-meta-userId'],
                    'x-amz-server-side-encryption-customer-algorithm':
                        params['x-amz-server-side-encryption-customer-algorithm'],
                    'x-amz-server-side-encryption-customer-key': params['x-amz-server-side-encryption-customer-key'],
                    'x-amz-server-side-encryption-customer-key-MD5':
                        params['x-amz-server-side-encryption-customer-key-MD5'],
                    'x-amz-acl': 'private'
                };
                superagent
                    .put(url)
                    .withCredentials()
                    .set('Content-Type', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet')
                    .set(customHeaders)
                    .send(file)
                    .end((err, res) => {
                        if (err) {
                            return reject(err);
                        }
                        console.error(res, err);
                        resolve(res);
                    });
            });
        }
    // ...

I keep getting a 307 back from S3, which won't work with CORS of course. I've done some reading and some people said that it was a temporary issue related to DNS sync on the S3 but it doesn't seem to have passed even when waiting for 24+ hours.

• The CORS config is as follows:

  <?xml version="1.0" encoding="UTF-8"?>
  <CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
      <CORSRule>
          <AllowedOrigin>http://localhost:3000</AllowedOrigin>
          <AllowedMethod>PUT</AllowedMethod>
          <AllowedHeader>*</AllowedHeader>
      </CORSRule>
  </CORSConfiguration>
  

If I replace the us-west-2 region (to get https://bucket-name.s3.amazonaws.com), I get a 403 forbidden response. If I don't, I get a 307 for https://bucket-name.s3.us-west-2.amazonaws.com. The browser (rightly) complains with:

Access to XMLHttpRequest at 'MY URL' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.

Any help would be really appreciated - thank you!