CORS

Browsers block requests from one origin (like localhost:5173) to a different one (like localhost:3000) unless the server allows it. That rule is CORS. The cors package adds the headers that tell the browser which origins are allowed.

npm install cors

import express from "express"
import cors from "cors"

const app = express()

// Allow only your frontend
app.use(cors({ origin: "http://localhost:5173" }))

// Allow several origins
app.use(cors({ origin: ["http://localhost:5173", "https://myapp.vercel.app"] }))