title: ANGULAR: No 'Access-Control-Allow-Origin' header is present on the requested resource
body: <p>I was able to pass this error with some local temporary fixes. But now, I'm moving the application to web. Trying to figure out this CORS error for two days. On my VDS I have x.x.x.x:4200 and x.x.x.x:3000 as angular and nodejs/express setup. Both can be accessible on internet.</p>
  
  <p>What I have tried:</p>
  
  <ul>
  <li>Set CORS related headers on both client and server.</li>
  <li>Set <code>app.use(cors());</code></li>
  </ul>
  
  <p>Maybe my tries were wrong so you can suggest same ways with some clarifications.</p>
  
  <p><a href="https://i.stack.imgur.com/PZ2aw.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/PZ2aw.png" alt="enter image description here"></a></p>
  
  <p>Get request on client side:</p>
  
  <pre><code>apiUrl = 'http://46.245.165.120:3000/';
  this.http.get(this.apiUrl + `users/${type}`, { headers: { 'Authorization': `Bearer ${this.getToken()}` ,
            'Access-Control-Allow-Origin':'*',
            'Access-Control-Allow-Methods': 'GET, POST, PATCH, PUT, DELETE, OPTIONS',
            'Access-Control-Allow-Headers': 'Origin, Content-Type, X-Auth-Token'
          }});
  </code></pre>
  
  <p>Server side headers and CORS setup:</p>
  
  <pre><code>var originsWhitelist = [
      'http://localhost:4200',      //this is my front-end url for development
      'http://x.x.x.x:4200',
      'http://www.myproductionurl.com'
  ];
  var corsOptions = {
      origin: function (origin, callback) {
          var isWhitelisted = originsWhitelist.indexOf(origin) !== -1;
          callback(null, isWhitelisted);
      },
      credentials: true
  };
  app.use(cors(corsOptions));
  
  const allowCrossDomain = function (req, res, next) {
  
      var origin = req.headers.origin;
  
      if (originsWhitelist.indexOf(origin) &gt; -1) {
          res.header('Access-Control-Allow-Origin', origin);
      }
  
      res.header('Access-Control-Allow-Methods', 'OPTIONS, GET, POST'); // added OPTIONS as an allowed method
      res.header('Access-Control-Allow-Headers', 'X-Requested-With,content-type,x-access-token');
      res.header('access-control-allow-credentials', true);
  
      return next();
  }
  
  app.use(allowCrossDomain)
  </code></pre>