Enable CORS on Kibana

Have you enabled the xpack.security.sameSiteCookies option mentioned above in your config? From this thread that looks to be the missing piece.