I have a project that is having issues with CORS in production. In order to reproduce it I have exposed my localhost instance to ngrok. First time I got the CORS error as I expected, but not anymore, do I have to configure something else?

• I emptied my browser cache and used incognito.
• I have also ran ngrok http --domain=domain-name.ngrok-free.app --response-header-add="Access-Control-Allow-Origin:zero" 8080 just to force the CORS, no luck.

This is the graphql server file that should cause the CORS error:

const requestHandler =
  handlers.createAPIGatewayProxyEventRequestHandler<APIGatewayProxyWithCognitoAuthorizerEvent>();

const corsMiddleware: middleware.MiddlewareFn<typeof requestHandler> = async () => {
  return async (result) => {
    result.headers = { ...result.headers, 'Access-Control-Allow-Origin': '*' }; // this should avoid the CORS blocked but it's happening in prod.
  };
};

const server = createPrivateServer();

const lambdaHandler = startServerAndCreateLambdaHandler(server, requestHandler, {
  middleware: [corsMiddleware],
  context: async ({ event }) => {
    // context
  },
});

export const handler = middy(lambdaHandler)
  .use(doNotWaitForEmptyEventLoop({ runOnBefore: true }))
  .use(captureLambdaHandler(tracer))
  .use(injectLambdaContext(logger, { clearState: true }))