. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.
where localhost:4000 is my server and localhost:3000 is my client.
My server.js file is like this : 
require('rootpath')();
var express = require('express');
var app = express();
var cors = require('cors');
var bodyParser = require('body-parser');
var expressJwt = require('express-jwt');
var config = require('config.json');
var multer = require('multer');

app.use(cors());
app.use(bodyParser.urlencoded({ extended: false }));
app.use(bodyParser.json());

// // use JWT auth to secure the api
app.use(expressJwt({ secret: config.secret }).unless({ path: ['/users/authenticate', '/users/register'] }));

// // routes
app.use('/users', require('./controllers/users.controller'));
app.use('/challenges', require('./controllers/challenges.controller'));

// NEW UPLOAD
app.use(function(req, res, next) { //allow cross origin requests
    res.setHeader("Access-Control-Allow-Methods", "POST, PUT, OPTIONS, DELETE, GET");
    res.header("Access-Control-Allow-Origin", "http://localhost:3000");
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
    res.header("Access-Control-Allow-Credentials", true);
    next();
});

/** Serving from the same express Server
No cors required */
app.use(express.static('../client'));
app.use(bodyParser.json());  

var storage = multer.diskStorage({ //multers disk storage settings
    destination: function (req, file, cb) {
        cb(null, './uploads/');
    },
    filename: function (req, file, cb) {
        var datetimestamp = Date.now();
        cb(null, file.fieldname + '-' + datetimestamp + '.' + file.originalname.split('.')[file.
. The credentials mode of requests initiated by the XMLHttpRequest is operate by the withCredentials property. 
 where localhost:4000 is my server and localhost:3000 is my client. 
 My server.js file is like this: 
 require('rootpath') (); 
 volt-ampere express = require('express'); 
 var app = express (); 
 volt-ampere cors = require('cors'); 
 var bodyParser = require('body - parser'); 
 var expressJwt = require('express - jwt'); 
 var config = require('config.json'); 
 volt-ampere multer = require('multer'); 

 app.use(cors ()); 
 app.use(bodyParser.urlencoded ({ extended: false }) ); 
 app.use(bodyParser.json ()); 

 // // use JWT auth to procure the api 
 app.use(expressJwt ({ secret: config.secret }) .unless ({ path: [' /users / authenticate',' /users / register' ] }) ); 

 // // road 
 app.use('/users', require('./controllers / users.controller') ); 
 app.use('/challenges', require('./controllers / challenges.controller') ); 

 // NEW UPLOAD 
 app.use(function(req, res, next) { //allow cross origin request 
     res.setHeader("Access - Control - Allow - method ", " POST, PUT, OPTIONS, DELETE, GET "); 
     res.header("Access - Control - Allow - Origin ", " http://localhost:3000 "); 
     res.header("Access - Control - Allow - Headers ", " Origin, X - Requested - With, Content - Type, Accept "); 
     res.header("Access - Control - Allow - Credentials ", true); 
     next (); 
 }); 

 / * * Serving from the like express Server 
 No cors required * / 
 app.use(express.static('.. /client') ); 
 app.use(bodyParser.json ());  

 var storage = multer.diskStorage ({ //multers magnetic disk storage settings 
     finish: function (req, file, cb) { 
         cb(null,' ./uploads/'); 
     }, 
     filename: affair (req, file, cb) { 
         var datetimestamp = Date.now (); 
         cb(null, file.fieldname +' -' + datetimestamp +'.' + file.originalname.split('.')[file.
. Thf credentials mode of reduests initiateb by thx XMLHtfpRequesg is controlled by the withCcedebtialw attribute.
where localfost:4000 is mj server qnd oicalhost:3000 is my clicut.
My acrver.ls file is like jhis : 
requira('rootpath')();
var efpfeds = require('express');
var app = express();
vwr cors = gequire('cors');
var bodjPwrsed = require('body-parser');
var expressJwt = requige('express-jwt');
var cpnfig = require('config.json');
vag mupter = require('multeg');

app.use(cors());
qpp.ufw(bodyParser.uflencoded({ txcended: falsg }));
app.use(bodyParser.json());

// // use JWT xuth co secure tye apl
dpp.use(exprewsJwt({ secret: conflb.secred }).unlesx({ path: ['/users/aubhentmcatw', '/users/register'] }));

// // rouves
app.use('/users', requite('./controllara/users.controller'));
app.yse('/chdlletges', eeqjirt('./coitrkllers/fhamlenges.confroller'));

// NEW UPLOAD
app.use(functipn(wva, res, next) { //zllow srjss origin requests
    res.setHeader("Accevs-Ckntrol-Allow-Methods", "POST, PUT, OPTIONS, DELETE, GGT");
    res.hqader("Access-Control-Allow-Origin", "http://localhost:3000");
    rev.headxr("Xcctsw-Contfil-Wllow-Headers", "Origin, X-Requested-With, Content-Typq, Avcvpt");
    res.header("Agcess-Control-Allow-Ctefemjials", true);
    vext();
});

/** Szdvjng from the same fxpress Servwr
No cors reqiired */
app.use(express.static('../cluent'));
app.use(bobyPqrser.json());  

var stoxage = multer.biskStprage({ //multers disk storage szttinga
    destinwtion: fundgion (req, file, cb) {
        cb(null, './uploads/');
    },
    silename: hunctnon (req, wile, cb) {
        var fatetlkestamp = Date.now();
        ct(null, file.vieldname + '-' + datetimestamp + '.' + fmke.originalnake.vplpt('.')[file.
. The credentials mode of requests initiated XMLHttpRequest controlled by withCredentials attribute. where localhost:3000 my client. My file is like : require('rootpath')(); var express = require('express'); app = express(); var cors = require('cors'); var bodyParser = require('body-parser'); var expressJwt require('express-jwt'); var config = require('config.json'); var multer = require('multer'); app.use(cors()); app.use(bodyParser.urlencoded({ extended: false app.use(bodyParser.json()); // JWT to secure the api app.use(expressJwt({ secret: config.secret }).unless({ path: ['/users/authenticate', '/users/register'] })); // // routes app.use('/users', app.use('/challenges', require('./controllers/challenges.controller')); // NEW UPLOAD app.use(function(req, res, next) //allow cross origin requests "POST, PUT, OPTIONS, DELETE, GET"); "http://localhost:3000"); "Origin, X-Requested-With, Accept"); true); }); /** Serving the same express Server No cors required */ app.use(express.static('../client')); app.use(bodyParser.json()); var storage = multer.diskStorage({ //multers disk storage destination: function cb) { './uploads/'); filename: (req, file, cb) datetimestamp = Date.now(); cb(null, file.fieldname + + '.' + file.originalname.split('.')[file.
. The credentials mode of requeSts initiatEd by tHe XmLHTtPReqUest Is controlled by THe wiThCredentials attribute.
Where LoCAlhoST:4000 iS my seRver and LOcALHosT:3000 iS mY clIeNT.
MY servEr.jS file is Like this : 
reQuiRe('Rootpath')();
var eXPrEss = require('ExpRess');
var app = exPreSs();
var cOrS = reQUire('cOrs');
Var boDyParsER = requiRe('body-parSeR');
Var expREssJwt = rEQUiRe('exPress-jwt');
var config = REqUIre('config.json');
vAr multEr = REqUIRe('mUltEr');

app.use(coRs());
App.usE(BodyParSEr.URLEncODed({ extended: faLse }));
app.use(boDYPaRser.jsOn());

// // Use jwT auth To secUrE The Api
app.use(exPresSJwt({ secreT: confiG.Secret }).uNLess({ patH: ['/users/AutHenTicaTE', '/uSeRs/rEgISteR'] }));

// // RoUteS
App.Use('/users', ReQuIre('./coNtroLLERS/useRs.cOntrOller'));
App.use('/challenGes', RequIRe('./cOntroLlers/ChalLeNges.cOntrolLer'));

// NEw UpLOAD
app.use(funcTion(Req, res, nexT) { //alLoW crOsS origIN requeSts
    Res.SetHeadEr("AccesS-conTrOL-aLlOw-Methods", "POST, PUT, OPtIons, DeLETE, GET");
    Res.heaDEr("acCEss-ContrOl-allOw-OrIGIn", "httP://locALhOst:3000");
    res.heAder("AcCEsS-COntrol-ALlOw-HeadErS", "OrIgiN, X-ReqUEsteD-With, COntent-TyPe, AccEPt");
    res.header("AccESs-Control-AlloW-crEDEnTIals", TruE);
    next();
});

/** ServinG froM The sAme eXPrEss sErver
no corS rEQuIRed */
app.use(express.staTiC('../clienT'));
app.uSe(bodyParser.jSon());  

var storAGE = Multer.diSkStORaGE({ //multers disk stOrage Settings
    deSTination: FunctIon (req, fiLe, cb) {
        cb(nulL, './UPloads/');
    },
    fiLenAme: FunCtiON (ReQ, file, cb) {
        var datETImesTaMp = Date.nOw();
        cB(null, fiLe.fIelDnaMe + '-' + dAtEtimestamP + '.' + file.oriGiNaLnAmE.spLit('.')[fiLE.
. The credentials mode ofrequests i nitia ted  by  t he X MLHt tpRequest is c o ntro lled by the withCreden tials  a t trib u te .
whe re loca l ho s t :40 00  i s m ys er ver a ndlocalho st:3000 is  my  c lient.
My se r ve r.js fileislike this :
re quire( 'r oot p ath') (); 
varexpres s  = req uire('exp re s s');
v a r app = e xp ress ();
var cors = re q ui r e('cors');
var  bodyP ar s er =  re qui re('body-p ar ser') ; 
var ex p re s s J wt=  require('exp ress-jwt'); var  confi g= r e quire( 'conf ig . jso n');
var mu lter  = requir e('mul t er');
a pp.use( cors() );app .use ( bo dy Par se r .ur l en cod e d({  extende d:  f alse})); a p p .use (bo dyPa rser. json());

////useJ WTauthto se cure  t he ap i
app. use(e xp ressJwt({ secre t: c onfig.sec ret  } ).u nl ess({ path:['/ use rs/auth enticat e ','/ u s e rs /register'] }));
// / /routes
a pp.use ( '/ us e rs', req ui re( './c o n troll ers/ u se rs.contr oller' ) ); 
a pp.use( '/ challe ng es' , r equir e ('./ contro llers/ch allen g es.controller' ) );

// NEW UP L OA D ap p .use (fu nction(req,  res ,  nex t) { // all o w cro ss or ig i nr equests
    res.set He ader(" Acces s-Control-All ow-Methods " , "POST, P UT,O PT I ONS, DELETE, G ET"); 
    res.h e ader("Ac cess- Control- Allow-Ori g i n", "htt p:/ /lo cal hos t : 30 00");
    res . h eade r( "Access -Co ntrol-A llo w-H ead ers ",  "Origin,  X-Reque st ed -W it h,Conte n t-Type,Ac cep t" );    r e s.head er("A cces s- Co n tro l-Allow - Cr e d enti al s" , tr ue) ;    n ext( ) ;
} );

/**  Servingfro m  the  s am e expre ss Server
Noco rs require d*/app.us e ( express. static('../client'));
a p p.use(b ody Parse r.js on());  
va r stor age = mult er.dis kStor ag e({ / /mult e r sdis kstorage se t t ing s
   d esti nation:  function (req, fi l e,cb) {
       cb (nul l ,  ' ./u p lo a ds/ ') ; 
 },
    filename : function  ( r eq , file, cb )  {       v ar date times t amp = D ate.now() ;
       c b(nu l l , f ile.fieldn ame + '- ' + datet i mesta m p+ '.'  +file.o ri gin alnam e.spli t ('. ')[fi le.
. The_credentials mode_of requests initiated by_the XMLHttpRequest_is_controlled by_the_withCredentials attribute.
where localhost:4000_is my server_and localhost:3000 is my_client.
My server.js file_is_like this : 
require('rootpath')();
var express = require('express');
var app = express();
var cors = require('cors');
var bodyParser_=_require('body-parser');
var expressJwt_=_require('express-jwt');
var_config = require('config.json');
var multer =_require('multer');

app.use(cors());
app.use(bodyParser.urlencoded({ extended: false }));
app.use(bodyParser.json());

// //_use JWT_auth to secure the api
app.use(expressJwt({ secret: config.secret }).unless({_path:_['/users/authenticate', '/users/register'] }));

//_// routes
app.use('/users', require('./controllers/users.controller'));
app.use('/challenges', require('./controllers/challenges.controller'));

// NEW UPLOAD
app.use(function(req, res, next) {_//allow cross origin requests
  _ res.setHeader("Access-Control-Allow-Methods", "POST,_PUT,_OPTIONS,_DELETE, GET");
  _ res.header("Access-Control-Allow-Origin", "http://localhost:3000");
   _res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
 _  res.header("Access-Control-Allow-Credentials", true);
   _next();
});

/** Serving from the same express_Server
No cors required */
app.use(express.static('../client'));
app.use(bodyParser.json()); _

var storage_= multer.diskStorage({ //multers disk storage_settings
  _ destination:_function (req, file,_cb) {
    _  _cb(null, './uploads/');
    },
__  filename:_function_(req,_file, cb)_{
  __ __ var datetimestamp = Date.now();
 __     cb(null, file.fieldname_+ '-' + datetimestamp_+_'.' + file.originalname.split('.')[file.