First off... affiliate parameters are already saved by Shopify and are part of the order. You get the landing page, and any affiliate codes in the order itself. Dealing with cookies and checkout will never be of much use to use since you cannot do anything with checkout. You can inject script code in the Thank You page, and there you do have access to the order in Liquid, so you can get your codes from the order there.
Has nothing to do with CORS since you're dealing 100% with Shopify here and not an external App you control, where cross-domain Ajax might come in handy.