Hey, can you try to implement a middleware that adds an Access-Control-Allow-Origin header to every request?

The backend API works perfectly in Postman and curl.

CORS is browser related, Postman and curl will therefore work without any issue, regardless if CORS is set up correctly or not. Can you confirm that your application is actually making an OPTIONS preflight request? There is a chance that this is not happening as you are only sending simple requests https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#simple_requests.

Ive already implemented Middleware. but still it is not sending Access-Control-Allow-Origin in my header. but if i try the same in local im getting headers.

here im attaching the localhost response screenshot. and implementation details.

Is there any live support service in this paltform?

Sorry, there is no live support for hobby users, especially not for application level issues. Please confirm that your application is making a preflight OPTIONS request and provide screenshots of the response from Railway vs. locally.

I've already attached the screenshots of the response. i'm adding again here. and i don't think this is an application level issue.

Please log the origin and confirm that the whitelisted origins are indeed correct.

In your middleware remove the whole block for handling options manually and keep app.use(cors(corsOptions));

The manual block might already send headers and then the app.use(cors(corsOptions)); is of no use.

I've done the same. but still im gettign CORS error. for your reference ive attached the images here.

Change

app.use(cors(corsOptions));

to
app.use(cors({

origin: true,

credentials: true,

}));

If this works then it is the origin that is causing the problem.

Add some logs
origin: function (origin, callback) {

console.log('Incoming origin:', origin);

if (!origin || allowedOrigins.includes(origin)) {

callback(null, true);

} else {

console.warn('Rejected CORS origin:', origin);

callback(new Error('Not allowed by CORS'));

}

}

See if the origin matches the one in your list
const allowedOrigins = [

'http://localhost:4200',

'https://harka-ai-frontend.vercel.app',

'https://harkai.beyondaigen.com',

];

i also once fixed this issue and can help you out regarding the same if you can add me as collaborator in your repo as i cant figure out from here itself github username umez-57

Thank you @phoenixauro. its resolved now.