Is there any workarounds that allows me to keep the \"Prevent Cross Site Trackng\" option enabled (as it is by default, so every user will have it on), and issue CORS cookie
I'd suggest puting both your website and the api on the same domain, e.g. https://web.mydomain.com and https://api.mydomain.com. This shouldn't be too difficult to implement - I haven't found any simple technical solutions online yet that will force Safari on iOS to allow this without changing the settings.