CORS error persists in oAuth even after setting header

This can only happen when we choose implicit oAuth flow. How is this possible in oAuth authorization flow as in that the documentation clearly states in step 1 as follows:
Send the user you want to authenticate to **your registered redirect URI**. Then, an authorization page will ask the user to sign up or log into Twitch and allow the user to choose whether to authorize your application/identity system.

And it makes sense too.

All I am doing is sending the user to my app’s registered redirect URI which is the server endpoint that handles the auth as stated in the documentation. For reference, my server code is similar to this. Either I am doing something wrong or I guess the documentation is a bit misleading.