I will recommend you try two things:
In ajaxSetup do the following:
$.ajaxSetup({ ...., xhrFields: { withCredentials: true }, crossDomain: true, .... });
In your ajax requests, specify the full URL, for example, in addition to the credential flag.
'Access-Control-Allow-Origin: https://not-example.com' 'Access-Control-Allow-Credentials: true'
For authenticated servers, these browsers do not allow "*" in this header. The Access-Control-Allow-Origin header must contain the value of the Origin header sent by the client.
source share