Is there any workarounds that allows me to keep the \"Prevent Cross Site Trackng\" option enabled (as it is by default, so every user will have it on), and issue CORS cookie
The only feasible solution that I found to this problem was to create a proxy. I wrote an extensive guide on how to do this for Microsoft Azure
I'd suggest puting both your website and the api on the same domain, e.g. https://web.mydomain.com and https://api.mydomain.com. This shouldn't be too difficult to implement - I haven't found any simple technical solutions online yet that will force Safari on iOS to allow this without changing the settings.