Can't call login-page from JSS app

Question

I tried to follow this guide to login from the JSS-app, but I get an error when posting:

Access to XMLHttpRequest at 'https://myApp/sitecore/api/ssc/auth/login?sc_apikey={APIKey}' from origin 'http://localhost:3000' has been blocked by CORS policy: 
The value of the 'Access-Control-Allow-Credentials' header in the response is '' which must be 'true' when the request's credentials mode is 'include'. 
The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.

I've tried calling the dataFetcher.js's internal method (axios), but it doesn't work either.

My best fix is removing the withCredentials from dataFetcher.js and add the following to web.config:

<httpProtocol>
  <customHeaders>
    <remove name="X-Powered-By"/>
    <add name="Access-Control-Allow-Headers" value="Content-Type, Accept, X-Requested-With, Session"/>
    <add name="Access-Control-Allow-Credentials" value="true"/>
  </customHeaders>
</httpProtocol>

But I have no idea what else is using the dataFetcher, so I'm not sure this is the best method to get around it.