API -> Upload files via custom widget and if the file upload hits the 403 error sometimes

This error is exactly the error listed in the article.  The session ID is not being sent properly, so the request is being routed to a different server.  You need to go back and check your implementation for that.

You may be right that the browser does not support reading/setting cookie headers in cross-origin situations (I don't know, but you could well be right).  Debugging what's happening in those situations (i.e. does it actually work?) would be good.

If you cannot set these then I think you have three options:

1. Avoid using these style authentication tokens.  You can send credentials via headers, for example.  Maybe not great, but it looks like you probably already have these stored client-side anyway so it's probably not materially more insecure than you already have.

2. Use something server-side, rather than client-side, to interact with the API.  This means creating some middleware instead, but it would resolve the CORS issues.

3. Speak to M-Files support about whether the CORS changes you need can be configured or not.  I haven't encountered this before so I don't know what those CORS changes might need to be.