Проблема корс прокси в облаке с учетом идентификационных данных | React, Django
I deployed two different services on Google App engine. I want to use IAP for security. Service A is a Django Rest backend, second service is React Client. I have Cors issue i can't resolve. In React i use react-google-login to get Authorization Berer token to make request to my backend. When i try to make request from client to backend i have cors issue like on picture below: 
If i copy this request as curl and put it into postman and send it, i get 200 and expected response from backend. If i disable IAP, there is no cors problem, frontend app gets 200 from backend. My django settings accept all cors origins. What am I missing guys? I guess it must be something very simple. I tried different axios/fetch options like withCredentials, refererPolicy, headers etc. Also when i run chrome without web security app works fine. In django setting i have CORS_ORIGIN_ALLOW_ALL= True, CORS_ALLOW_ALL_ORIGINS = True ALLOWED_HOSTS = ['*'] i don't think this is backend problem. My react code: 