I am trying to deploy a MERN app through Vercel. Problem is that I am really confused as to how I should implement CORS settings. This is what my code looks like right now for index.js

import { router } from "./routes/index.js";

// environment variable
dotenv.config({ path: "./.env" });

// connect to database
mongoose
  .connect(process.env.MONGODB_URI, {
    useNewUrlParser: true,
    useUnifiedTopology: true,
  })
  .then((result) => {
    console.log("Successfully connected to the database");
  })
  .catch((err) => {
    console.log(err);
  });

// Configure express-session middleware with connect-mongodb-session
const MongoDBStore = connectMongoDBSession(session);

// Create a MongoDB session store
const store = new MongoDBStore({
  uri: process.env.MONGODB_URI,
  collection: 'sessions', // Collection name to store sessions
});

// Handle MongoDB connection errors
store.on('error', function (error) {
  console.error('Session Store Error:', error);
});

// instantiate the server
const app = express();
app.use(cookieParser());
app.use(session({
    secret: "your-secret-key",
    resave: false,
    saveUninitialized: true,
    store: store,
    cookie: {
        maxAge: 24*60*60*1000,
        secure: false, // Set to true in production with HTTPS
        httpOnly: true,
        sameSite: "none",
        domain: ".sp2-chi.vercel.app"
    },
}));

app.use(express.json());
app.use(express.urlencoded({ extended: true }));

// Add CORS middleware to allow all origins (*)
app.use(cors({
  origin: 'https://ai-learn-omega.vercel.app', // Allow requests from this origin

  credentials: true // Allow credentials (cookies, sessions)
}));

app.use((req, res, next) => {
  res.header("Access-Control-Allow-Origin", "https://ai-learn-omega.vercel.app"); // Replace with your frontend origin
  res.header("Access-Control-Allow-Credentials", true);
  res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
  next();
});


app.use("/", router);

// start the server
app.listen(process.env.PORT, (err) => {
  if (err) {
    console.log(err);
  } else {
    console.log(`Server listening at port ${process.env.PORT}`);
  }
});

and this is what my vercel.json looks like

    {
    "version": 2,
    "builds": [
        {
            "src": "*.js",
            "use": "@vercel/node"
        }
    ],
    "routes": [
        {
            "src": "/(.*)",
            "dest": "/index.js",
            "headers": [
                { "key": "Access-Control-Allow-Credentials", "value": "true" },
                { "key": "Access-Control-Allow-Origin", "value": "*" },
                { "key": "Access-Control-Allow-Methods", "value": "GET,OPTIONS,PATCH,DELETE,POST,PUT" },
                { "key": "Access-Control-Allow-Headers", "value": "X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version" }
              ]
        }
    ]
}

From what I have discovered so far, it seems that vercel overwrites any settings made in index.js. I havent removed them just yet, but it seems that is the case when testing. As of now, I get this error.

https://sp2-chi.vercel.app/auth/login' from origin 'https://ai-learn-omega.vercel.app' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.