I opened an issue yesterday to describe this defect [1]: A webaction with a require-whisk-auth annotation will fail all preflight checks. This is because the action authorization is checked before the router enters the options handling.
I have opened a pull request to address the defect: https://github.com/apache/openwhisk/issues/4879. This patch fixes the bug by refactoring the handler so that it is possible to respond to OPTIONS first, before proceeding with authentication checks. -r [1] https://github.com/apache/openwhisk/issues/4879