Nginx – Facing a CORS policy issue when requesting from my deployed IP address site at EC2 instance

Assuming 13.200.107.25 is your ubuntu server the backend NojeJs + Express should be:

const express = require('express');
const cors = require('cors');
require('dotenv').config();

const app = express()
const port = process.env.PORT || 5000; // ALLOWED PORT IN FIREWALL

app.use((req, res, next) => {
    res.header('Access-Control-Allow-Origin', '*');
    res.header('Access-Control-Allow-Methods', 'GET,HEAD,OPTIONS,POST,PUT');
    res.header('Access-Control-Allow-Headers', 'Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers');
    next(); // DONT FORGET THIS!!!
});
app.use(cors()); // default cors, you can change here the options


// midleware to use API Endpoints
app.use(express.json());


// Serving client react app build 
const path = require('path');
const _dirname = path.dirname("");
const buildPath = path.join(_dirname , "../client/build");

app.use(express.static(buildPath));

app.get('/*', (req, res) => {
  res.sendFile(
    path.join(__dirname, "../client/build/index.html"),
    (err) => {
      if(err)
      {
        res.status(500).send(err);
      }
    }
  )
})


//Available Routes
//app.use('/api/auth', require('./Routes/authRoute')); YOURS
// The api can be accessed like this: http://server/api
// Like so, you can add other webservices at the same server like http://server/api1 http://server/api2 ... 

app.use('/auth', require('./Routes/authRoute'));


app.listen(port, () => {
  console.log(`iNotebook listening at http://localhost:${port}`)
})

Nginx should be:

server {
    listen 80;
    listen [::]:80;
    # root /var/www/html; you can use for FRONT-END LATER

    #server_name yourdomain.com www.yourdomain.com;
    server_name 13.200.107.25;

    location / {
               # First attempt to serve request as file, then
               # as directory, then fall back to displaying a 404.

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_connect_timeout 2s;
        proxy_set_header 'Access-Control-Allow-Origin' *;
        proxy_set_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, DELETE';
        proxy_set_header 'Access-Control-Allow-Headers' 'X-Requested-With,Accept,Content-Type, Origin';

        proxy_redirect     off;

        proxy_set_header   Host             $host;
        proxy_set_header   X-Real-IP        $remote_addr;
        proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;

        add_header 'Cache-Control' 'no-cache, must-revalidate, max-age=0';
        # add response CORS headers
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
        add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
        
        expires off;

        gzip_static on;

        gzip on;
        gzip_disable "msie6";

        gzip_vary on;
        gzip_comp_level 6;
        gzip_proxied any;
        gzip_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;

        try_files $uri /index.html index.html;
    }


    location ~ .(html)$ {
               add_header Pragma "no-cache";
               add_header Cache-Control "no-store";
               add_header strict-transport-security "max-age=31536000";
               add_header X-Frame-Options "SAMEORIGIN";
               try_files $uri /index.html;
    }
    location ~ .(css|htc|less|js|js2|js3|js4)$ {
               expires 31536000s;
               add_header Pragma "public";
               add_header Cache-Control "max-age=31536000, public";
               try_files $uri /index.html;
    }

    location /api/ {
        rewrite ^/api/?(.*)$ /$1 break;    
        proxy_pass  http://127.0.0.1:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    error_page  405     =200 $uri;
}

http://13.200.107.25/api will access your backend API.