@User try to change the CORS block to:

app.use(
  cors({
    origin: "http://localhost:3000",
    allowedHeaders: ["content-type", ...supertokens.getAllCORSHeaders()],
    credentials: true,
    methods: ["GET", "PUT", "POST", "DELETE"],
  }),
)

Basically added the

methods

key as well.