CORS (Cross-Origin Resource Sharing) is a browser security mechanism that decides whether one website is allowed to request resources from another.
Suppose your frontend runs on:
http://localhost:5173
Your API runs on:
http://localhost:3000
Same computer. Different ports. That makes them different origins.
Your browser blocks the request because the API never explicitly allowed requests from that origin.
"But it works in Postman..." Of course it does. Postman isn't a browser. It doesn't enforce browser security rules.
If Postman works but your browser doesn't, the problem usually isn't your API logic. It's your server's CORS configuration.