There was a similar issue resolved regarding cors seen here: https://community.databricks.com/t5/administration-architecture/databricks-rest-apis-cors-issue/td-p...

If this is just for your own development and testing you might consider allowing all in your react app but be careful of monitoring outside malicious requests with such a setting