Weird issue with CORS policy?

May not be phoenix, the problem could be in your browser. Some browser blocks local CORS for no apparent reasons.

oh really, now way. but there is no issue with the router right?

Check the response headers, which can be seen from the browser debug tool, to make sure.

there is a lot of informations but policy is strict-origin-when-cross-origin

removed plug cors, this is how my router.ex looks like

defmodule TestWeb.Router do
  use TestWeb, :router

  pipeline :api do
    plug TestWeb.Plugs.RateLimiter
    plug :accepts, ["json"]
    plug TestWeb.Plugs.AuthPlug
  end

  scope "/", TestWeb do
    pipe_through :api

    post "/login", UserController, :login
    post "/signup", UserController, :signup
    get "/test", UserController, :test

    # CORS stuff :(
    options "/login", UserController, :login
    options "/signup", UserController, :signup
    options "/test", UserController, :test
  end
end

My endpoint.ex looks like this

plug Corsica, origins: "*"

but what else do I have to add? because in the endpoint file I cant use pipeline as its a unknown function