How to configure RCE API with Nginx ?

I make this

server {
    listen          3000 SSL;
    server_name     xxxx.net;
    passenger_startup_file app.js;
    passenger_app_type node;
    ssl on;
    ssl_certificate /etc/letsencrypt/live/vmi370955.contaboserver.net/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/vmi370955.contaboserver.net/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot




location /var/canvas/canvas-rce-api {

    # Activer le proxy
    proxy_set_header                X-Real-IP $remote_addr;
    proxy_set_header                X-Forwarded-For $proxy_add_x_forwarded_for;
    # proxy_pass                    http://xxxx.net:3000;
    proxy_redirect                  off;
    proxy_buffers                   32 16k;
    proxy_busy_buffers_size         64k;

   }

but I still have problem cors !!

  Access to fetch at 'https://xxxxr.net:3000/api/folders? 
  contextType=course&contextId=1' from origin 'https://xxxx.net' has been 
blocked by CORS policy: Response to preflight request doesn't pass access control check: No 
'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque    
response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

I really added CORS headers but doesn't work

add_header 'Access-Control-Allow-Origin' 'https://xxxx.net:3000';
add_header 'Access-Control-Allow-Credentials' 'true';
add_header 'Access-Control-Allow-Headers' 'Authorization,Accept,Origin,DNT,X- 
CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache- 
Control,Content-Type,Content-Range,Range';
add_header 'Access-Control-Allow-Methods' 'GET,POST,OPTIONS,PUT,DELETE,PATCH';

any ideas please !

The issue centers on the Nginx server block for the Node app and the browser's CORS preflight error. Start by checking the shown proxy and CORS directives against the request origin and OPTIONS request; done means the reported preflight request receives the required response headers without the browser error.