X_CORS_CONFIG_INVALID

the cors config can never produce a working response

cors.origins contains '*' while cors.credentials is true — a pair no browser accepts, which used to resolve to no CORS headers at all rather than an error — or contains 'null', the origin every sandboxed iframe sends, which URL.parse('localhost:3000').origin produces

call configureHttp({ cors: { credentials: false } }) at module scope in a file under apps/*/, or replace origins: ['*'] with the exact origins allowed to call this app; for 'null', list the scheme: configureHttp({ cors: { origins: ['http://localhost:3000'] } })