title: Using fetch with Express, React, cors, cookies - 'Access-Control-Allow-Origin' header
body: <p>spent a lot of time trying to figure this out with no success. I'm trying to get csurf protection running with cookies. At the moment I've simplified the following code as much as I can. I'm running a fetch request from React to another server on Express. It gives the error:</p>
  <p><em>&quot;Access to fetch at 'http://localhost:3003/testlogin' from origin 'http://localhost:3000' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.&quot;</em></p>
  <p>As I understand, the 'Access-Control-Allow-Origin' header is set in my corsOptions. So it shouldn't throw this error. I'm clearly missing something. Any help gratefully received.</p>
  <p>Express server:</p>
  <pre><code>const cookieParser = require(&quot;cookie-parser&quot;);
  const cors = require('cors')
  const express = require(&quot;express&quot;);
  const csrf = require(&quot;csurf&quot;);
  
  const app = express();
  
  const csrfMiddleware = csrf({ cookie: true });
  
  app.use(cookieParser());
  
  const corsOptions = {
    origin: 'http://localhost:3000',   
    methods: &quot;GET,HEAD,POST,PATCH,DELETE,OPTIONS&quot;,
    credentials: true,               
    allowedHeaders: &quot;Content-Type, Authorization, X-Requested-With, Accept&quot;,
  }
  app.options('*', cors(corsOptions))
  
  app.use(csrfMiddleware);
  
  app.post(&quot;/testlogin&quot;, cors(corsOptions), (req, res) =&gt; {
    console.log('test login reached', );
    res.end(JSON.stringify({ status: &quot;success&quot; }));
  });
  
  const PORT = process.env.PORT || 3003;
  app.listen(PORT, () =&gt; {
    console.log(`Listening on http://localhost:${PORT}`);
  });
  </code></pre>
  <p>Front-end (react):</p>
  <pre><code>function testClick() {
    console.log(&quot;testClick Clicked&quot;);
  
    let urlToGetUserProfile = 'http://localhost:3003/testlogin'
  
    return fetch(urlToGetUserProfile, {
      method: &quot;POST&quot;,
      headers: {
        Accept: &quot;application/json&quot;,
        &quot;Content-Type&quot;: &quot;application/json&quot;,
      },
      credentials: &quot;include&quot;,
      body: JSON.stringify({ idToken: &quot;idTokengoeshere&quot; }),
    })
      .then((fetchResponse) =&gt; {
        console.log(fetchResponse);
      })
  }
  </code></pre>