In my very specific case the problem was related to the fact that I had one plugin in place that rewrite the class Discourse::Cors method def self.apply_headers(cors_origins, env, headers), thus, I didn’t have the behaviour of the Discourse source code defined at https://github.com/discourse/discourse/blob/master/config/initializers/008-rack-cors.rb#L44 but instead some custom thing that I don’t even need.
Once I remove the plugin I get back the core definition for CORS and everything works as expected.