Unlike simple requests (discussed above), "preflighted" requests first send an HTTP request by the OPTIONS method to the resource on the other domain, in order to determine whether the actual request is safe to send.
(https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS)
Due to CORS, cookies are not being sent along the preflight request. This behaviour is confirmed by that issue. https://bugs.chromium.org/p/chromium/issues/detail?id=377541
But what does happen if Set-Cookie is returned in the response? Does the browser remembers that new cookie or simply discards it?