The CORS issue you're facing seems to stem from potential configuration problems related to the handling of preflight requests (OPTIONS) in both your Express application and Nginx setup. But that's just a well educated guess based on my own experiences.

Review Browser Caching: Sometimes browsers cache CORS preflight results. To ensure you're testing with fresh headers, clear your browser cache or try the requests in a private/incognito window.

Double-check the headers you are allowing in your CORS configuration: The allowedHeaders in your Express CORS options include 'Content-Type' and 'Authorization'. If your frontend sends any other headers, you need to add those to the allowed list. For example, if you’re sending an X-Requested-With header, include that as well.

Verify Express Server is Listening to OPTIONS: If you have already set up your Express server to handle OPTIONS requests using app.options('*', cors(corsOptions));, make sure the endpoint you are testing (/auth/login) is covered by your CORS configuration as well.

Test CORS with CURL: You can test your API endpoint directly using curl:

curl -X OPTIONS https://qa.example.com/auth/page -H "Origin: http://localhost:3000" -i

This command will show you the response headers returned by your server for the OPTIONS request.

Problem solved?