I am trying to execute a simple get request from the browser with the below code:

var url = "https://some-url/gateway/auth/api/v1/userInfo";

var xhr = new XMLHttpRequest();
xhr.open("GET", url);

xhr.setRequestHeader("Cookie", "cookie"); //I am passing the valid cookie 

xhr.onreadystatechange = function () {
   if (xhr.readyState === 4) {
      console.log(xhr.status);
      console.log(xhr.responseText);
   }};

xhr.send();

I am passing the same cookie for the GET request from POSTMAN and that works. This actually works in the browser too if I open the website, take the cookie from one of the requests and execute the above code in dev tools console.

What I am not able to understand is if I open a blank tab and then in devtools console if I try to execute the same code, it throws a CORS correctly. Now to get past the CORS issue, I have opened chrome and disabled the web security executing something like this chrome.exe --user-data-dir="C:/Chrome dev session" --disable-web-security from run option.

Once I do this, the call fails with the below error.

Does someone know what could be causing it and how can I fix it?