Fail to enter password-protected link when using custom domain

[TM0088]

Password-proteced link can be created for both main domain and custom domain, however only link of main domain can be entered with password, link of custom domain have no response after entering correct password.

P.S. It happens after setting homepage (other than the main domain) of the custom domain.

Hint from Browser terminal :
Access to XMLHttpRequest at 'https://alternative_homepage/' (redirected from 'https://custom_domain/api/links/xxxxxx/protected') from origin 'https://custom_domain' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: Redirect is not allowed for a preflight request.

[jsstrn]

Encountered the same issue. Seems the only workaround is to either not use password protected links while you have a homepage on your custom domain or to not have a homepage for your custom domain.