I need your help with this one. I’ve looked round the internet and can’t work out what I’m doing wrong…..CORS….it’s a pain!

In my Program.cs, I have the following:

builder.Services.AddCors(options =>
{
   options.AddDefaultPolicy(policy =>
   {
       policy.WithOrigins("http://localhost:4200", "https://dev-backoffice.mydomain.com", "https://backoffice.mydomain.com")
           .AllowAnyHeader()
           .AllowCredentials()
           .AllowAnyMethod();
   });
});

and

app.UseCors(); 
app.UseStaticFiles();

But I still get a CORS error:

Access to fetch at ‘https://dev-api.mydomain.com/v1/authenticate’ from origin ‘https://dev-backoffice.mydomain.com’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. If an opaque response serves your needs, set the request’s mode to ‘no-cors’ to fetch the resource with CORS disabled

Any ideas out there? I thought with what I put I more or less opened up everything as long as it came from one of the urls I gave.