One workaround we tried on dispatcher, In our dispatcher we allow "*" for /clientheaders.So, we add all the headers seen in browser instead of "*" and remove "Origin" header from there then the font is loading (response: 200). But with "Origin" it won't work. Not sure is it the correct solution.