how can i fix 403 error in oauth/access_token for twitter api (it work with --disable-web-security)?

i am trying create API for twitter in my app

my front is react and backend is javascript (express)

in authentication ( 3 step base on twitter docs )

step 1 and 2 goes well but in step 3 (oauth/access_token) it return 403 status in normaly open chrome or firefox , but when i open chrome with --disable-web-security , its work well !!! i am confused! anyone can help me with that ???

my code :

       
        try {
          //Oauth Step 3
          var username = await axios({
            url: `${apiPath}/twitter/oauth/access_token`,
            method: "POST",

            data: { oauth_token, oauth_verifier },
          });
        } catch (error) {
          console.error(error);
        }
        console.log(username);
      }

and express :

app.use(bodyParser.json());
app.use(cookieParser());
app.use(cors());



router.post("/twitter/oauth/access_token", async (req, res) => {
  try {
    const { oauth_token: req_oauth_token, oauth_verifier } = req.body;
    const oauth_token = req.cookies[COOKIE_NAME];
    const oauth_token_secret = tokens[oauth_token].oauth_token_secret;
    if (oauth_token !== req_oauth_token) {
      res.status(403).json({ message: "Request tokens do not match" });
      return;
    }
    const { oauth_access_token, oauth_access_token_secret , results } =
      await oauth.getOAuthAccessToken(
        oauth_token,
        oauth_token_secret,
        oauth_verifier
      );
    tokens[oauth_token] = {
      ...tokens[oauth_token],
      oauth_access_token,
      oauth_access_token_secret,
      results
    };
    res.json( {screen_name : tokens[oauth_token].results.screen_name}); 
  } catch (error) {
    res.status(403).json({ message: "Missing access token" });
  }
});

ps: disable web security of chrome with this : ( shotcut it )

"...\chrome.exe" --disable-web-security --user-data-dir="c:/chromedev"

in normally open chrome : inspect-network

in normally open chrome : headers

with --disable-web-security open chrome : inspect-network

with --disable-web-security open chrome : headers

thanks ☺