CORS irule query

A more appropriate version of your iRule would look like this:

when HTTP_REQUEST { 
    HTTP::header insert Access-Control-Allow-Credentials true            
    HTTP::header insert Access-Control-Allow-Origin * 
}

The HTTP_REQUEST event already operates in the client side context, so the clientside command is not necessary. As for CORS functionality, if you post a capture of what it should look like when it works natively, it may make it easier to emulate here.