You need to switch the order of route declaration: 

That's because /* will also match /api, and Express doesn't match based on which route matches best, but which route matches first.

Always declare more specific routes before less specific routes.

https://stackoverflow.com/questions/39844670/express-app-get-and-api-cors-issue