Problem with the CORS

Question

I’m developing an api for an education platform, and so created my private and public routes. The public are for creation and validation of token, then use it to access the routes but Cors, for some reason, is blocking the requests on private routes, not blocking routes, but on server request. I was wondering what this could be, here is the code with route file:

const express =require('express')
const routes = express.Router()
const {save,get,getById} = require('../api/user')
const {saveCategory,removeCategory,getCategory,getCategoryById,getTree} =require('../api/category')
const {saveArticles,removeArticles,getArticles,getArticlesById,getArticlesByCategory} =require('../api/articles')
const {signin,validateToken} = require('../api/utils/auth')
const {authenticate} =require('./passport')

routes.post('/signup',save)
routes.post('/signin',signin)
routes.post('/validateToken',validateToken)

routes.route('/users')
        .all(authenticate)
        .post(save)
        .get(get)

routes.route('/users/:id')
        .all(authenticate)
        .get(getById)
        .put(save)

routes.route('/categories')
        .all(authenticate)
        .get(getCategory)
        .post(saveCategory)
   
        // Rota tree deve vir antes de categories/id     

routes.route('/categories/tree')
        .all(authenticate)
        .get(getTree)

routes.route('/categories/:id')
        .all(authenticate)
        .get(getCategoryById)
        .put(saveCategory)
        .delete(removeCategory)


routes.route('/articles')
        .all(authenticate)
        .get(getArticles)
        .post(saveArticles)

routes.route('/articles/:id')
        .all(authenticate)
        .get(getArticlesById)
        .put(saveArticles)
        .delete(removeArticles)        
        
routes.route('/categories/:id/articles')
        .all(authenticate)
        .get(getArticlesByCategory)






module.exports =routes

And this here is where I call Cors:

const express =require('express')
const app = express()
const bodyParser =require('body-parser')
const consign = require('consign')
const db = require('./config/db')
const routes = require('./config/routes')
const cors =require('cors')



//app.use(cors)
//app.db=db
app.use(bodyParser.json())
app.use(routes)

The method that gives block, and calls the authentication service is . All()

Dai if you take the method All(), the routes return to normal.