Answer
Rather than trying to enable CORS directly on the IFS environment for this, set up a small proxy API layer that your browser-based app or Swagger UI calls instead of hitting IFS projections directly — beyond resolving the CORS error, having your own API layer in front of IFS gives you a natural place to apply broader integration best practices (like consistent auth handling and request shaping) as the integration grows.