1. The app sends credentials: "include" on every request. Normal CORS proxies set Origin: * - browser rejects that with credentials. You need a proxy that echoes back the real origin instead.