Wow you wrote a lot, but I read it. What it reminds me of is CORS, which means cross origin resource sharing. I don't know if that's your issue, the term origin is pretty overloaded in our lives. I share https://en.wikipedia.org/wiki/Cross-origin_resource_sharing only because there are a lot of useful links in the references section of the article regarding headers and whatnot. Also a DDG search of "AWS Cognito + CORS" shows a bunch of interesting stuff.