Are CORS on express response errors not supposed to get sent to the client?

[larssn]

So I have this hosting block in firebase.json (uses web frameworks):

{
  "target": "signup",
  "source": "../signup",
  "rewrites": [
    {
      "source": "/api/**",
      "function": "signup",
      "region": "europe-west1",
      "pinTag": true
    },
    {
      "source": "**",
      "destination": "/index.html"
    }
  ],
  "headers": [
    {
      "source": "/api/**",
      "headers": [
        {
          "key": "Access-Control-Allow-Origin",
          "value": "*"
        },
        {
          "key": "Access-Control-Allow-Methods",
          "value": "*"
        }
      ]
    }
  ]
}

A simple test is:

app.post('/api/accept-invite', async (req, res) => {
  res.sendStatus(200)
})

It works well from Chrome, I can see the CORS headers getting returned from Firebase Hosting. Good 👍🏻

However if I change the above to:

app.post('/api/accept-invite', async (req, res) => {
  res.sendStatus(400)
})

I can see from Chrome's Network tab that the HTTP 400 is received, but no CORS headers are returned, and Chrome discards the response (as it should).

Anything I'm misunderstanding here?