title: CORS Issue - Angular 8 - NodeJS & ExpressJS
body: <p>I've tried a few different solutions from other threads and suspect I'm missing something small here.</p>
  
  <p>I have an AngularJS 8 application, running on Node 10 with ExpressJS. Having some CORS issues when trying to access Google's People API.</p>
  
  <p><code>Access to XMLHttpRequest at 'https://developers.google.com/people/api/rest/v1/people.connections' from origin 'http://app.x.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource</code></p>
  
  <p>My frontend code looks like:</p>
  
  <pre><code>    return this.httpClient.get(this.API_URL, {
        headers: new HttpHeaders({
          Authorization: `Bearer ${authtoken}`,
          'Access-Control-Allow-Origin': 'http://localhost:4200',
          'Access-Control-Allow-Credentials': 'true',
        })
      });
    }
  </code></pre>
  
  <p>My server side code:</p>
  
  <pre><code>
  let express = require('express'),
    path = require('path'),
    cors = require('cors');
  // Connecting mongoDB
  var compression = require('compression')
  var session = require("express-session");
  
  let app = express();
  app.use(session({
    secret: '#######################',
    resave: false,
    saveUninitialized: true,
    cookie: { secure: true }
  }));
  app.use(compression())
  app.use(cors());
  
  app.use(function (req, res, next) {
    res.header("Access-Control-Allow-Origin", "*");
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
    next();
  });
  
  
  /*var corsOptions = {
    origin: '*',
    optionsSuccessStatus: 200 // some legacy browsers (IE11, various SmartTVs) choke on 204
  }
  app.use(cors(corsOptions));
  */
  
  app.use(express.static(path.join(__dirname, 'dist/###')));
  app.use('/*', express.static(path.join(__dirname, 'dist/##')));
  // Create port
  const port = 8080;
  const server = app.listen(port, () =&gt; {
    console.log('Connected to port ' + port)
  })
  
  // Find 404 and hand over to error handler
  app.use((req, res, next) =&gt; {
  
    res.setHeader('Access-Control-Allow-Origin', 'http://localhost:8888');
  
    // Request methods you wish to allow
    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');
  
    // Request headers you wish to allow
    res.setHeader('Access-Control-Allow-Headers', 'X-Requested-With,content-type');
  
    // Set to true if you need the website to include cookies in the requests sent
    // to the API (e.g. in case you use sessions)
    res.setHeader('Access-Control-Allow-Credentials', true);
  
    // Pass to next layer of middleware
    next();
  });
  
  
  app.use(function (err, req, res, next) {
    console.error(err.message);
    if (!err.statusCode) err.statusCode = 500;
    {
      res.status(err.statusCode).send(err.message);
    }
  
  
    res.setHeader('Access-Control-Allow-Origin', 'http://localhost:4200');
  
    // Request methods you wish to allow
    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');
  
    // Request headers you wish to allow
    res.setHeader('Access-Control-Allow-Headers', 'X-Requested-With,content-type');
  
    // Set to true if you need the website to include cookies in the requests sent
    // to the API (e.g. in case you use sessions)
    res.setHeader('Access-Control-Allow-Credentials', true);
  
    // Pass to next layer of middleware
    if (!err.statusCode) err.statusCode = 500;
    {
      res.status(err.statusCode).send(err.message);
    }
  
  
    res.setHeader('Access-Control-Allow-Origin', 'http://localhost:8888');
  
    // Request methods you wish to allow
    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS, PUT, PATCH, DELETE');
  
    // Request headers you wish to allow
    res.setHeader('Access-Control-Allow-Headers', 'X-Requested-With,content-type');
  
    // Set to true if you need the website to include cookies in the requests sent
    // to the API (e.g. in case you use sessions)
    res.setHeader('Access-Control-Allow-Credentials', true);
  
    // Pass to next layer of middleware
    next();
  });
  
  
  </code></pre>
  
  <p>As you can see, I've tried a couple of different approaches. Would appreciate any suggestions.</p>
  
  <p>Thank You</p>