GET
http://localhost:1234/bca-04.8896aac3.png?1746210478964
[HTTP/1.1 304 Not Modified 2ms]

GET
http://localhost:1234/bca-01.c5e42891.png?1746210478964
[HTTP/1.1 304 Not Modified 1ms]

GET
http://localhost:1234/bca-03.69a67984.png?1746210478964
[HTTP/1.1 304 Not Modified 1ms]

XHRGET
http://localhost:5000/api/api-security/csrf-token
[HTTP/1.1 200 OK 4ms]

XHRGET
http://localhost:5000/api/api-security/csrf-token
[HTTP/1.1 200 OK 14ms]

Object { csrfParam: "_csrf", csrfToken: "GaahZno-bhgi8narO7sL6dSR7RgNmLPviv6Aio_orrtfxOY0DF8JehC2G8dWg3uBrfWidGvU-r7oyMH6y7L6gw==" }
Signup.tsx:125:12
XHRGET
http://localhost:5000/api/api-signup/business-categories
[HTTP/1.1 200 OK 13ms]

XHRGET
http://localhost:5000/api/api-signup/business-categories
[HTTP/1.1 200 OK 17ms]

XHROPTIONS
http://localhost:5000/api/api-signup/stage-one-email
[HTTP/1.1 200 OK 9ms]

XHRPOST
http://localhost:5000/api/api-signup/stage-one-email
[HTTP/1.1 200 OK 523ms]

XHROPTIONS
http://localhost:5000/api/api-signup/stage-one-verify
[HTTP/1.1 200 OK 4ms]

XHRPOST
http://localhost:5000/api/api-signup/stage-one-verify
[HTTP/1.1 200 OK 142ms]

XHROPTIONS
http://localhost:5000/api/api-signup/stage-two-credentials?id=27
CORS Missing Allow Origin

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:5000/api/api-signup/stage-two-credentials?id=27. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 404.

XHRPOST
http://localhost:5000/api/api-signup/stage-two-credentials?id=27
NS_ERROR_DOM_BAD_URI

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://localhost:5000/api/api-signup/stage-two-credentials?id=27. (Reason: CORS request did not succeed). Status code: (null).

(2025-05-03T00:35:13.106Z) Unhandled error: 
Object { stack: 'AxiosError@http://localhost:1234/public.6efbc4f8.js:54126:23\nhandleError@http://localhost:1234/public.6efbc4f8.js:55136:20\nEventHandlerNonNull*dispatchXhrRequest@http://localhost:1234/public.6efbc4f8.js:55133:9\n.ao6fA</exports.default<@http://localhost:1234/public.6efbc4f8.js:55070:12\ndispatchRequest@http://localhost:1234/public.6efbc4f8.js:54301:12\npromise callback*_request@http://localhost:1234/public.6efbc4f8.js:52185:45\nrequest@http://localhost:1234/public.6efbc4f8.js:52098:31\nhttpMethod@http://localhost:1234/public.6efbc4f8.js:52239:25\nwrap@http://localhost:1234/public.6efbc4f8.js:52050:19\nsubmitSignupStageTwoCredentials@http://localhost:1234/public.6efbc4f8.js:70354:59\nSignup/submitStage<@/__parcel_hmr/365c22778ae0c7f4:271:57\nasync*onSubmit@/__parcel_hmr/365c22778ae0c7f4:662:43\nexecuteDispatch@http://localhost:1234/public.6efbc4f8.js:10174:21\nrunWithFiberInDEV@http://localhost:1234/public.6efbc4f8.js:2828:131\nprocessDispatchQueue@http://localhost:1234/public.6efbc4f8.js:10200:41\n.lu7uO</dispatchEventForPluginEventSystem/<@http://localhost:1234/public.6efbc4f8.js:10492:33\nbatchedUpdates$1@http://localhost:1234/public.6efbc4f8.js:3675:46\ndispatchEventForPluginEventSystem@http://localhost:1234/public.6efbc4f8.js:10276:25\ndispatchEvent@http://localhost:1234/public.6efbc4f8.js:12379:70\ndispatchDiscreteEvent@http://localhost:1234/public.6efbc4f8.js:12361:64\nEventListener.handleEvent*addTrappedEventListener@http://localhost:1234/public.6efbc4f8.js:10248:30\nlistenToNativeEvent@http://localhost:1234/public.6efbc4f8.js:10217:32\n.lu7uO</listenToAllSupportedEvents/<@http://localhost:1234/public.6efbc4f8.js:10223:96\nlistenToAllSupportedEvents@http://localhost:1234/public.6efbc4f8.js:10222:29\n.lu7uO</exports.createRoot@http://localhost:1234/public.6efbc4f8.js:15652:35\n["4dmnR"]<@http://localhost:1234/public.6efbc4f8.js:692:37\nnewRequire@http://localhost:1234/public.6efbc4f8.js:84:24\n@http://localhost:1234/public.6efbc4f8.js:144:15\n@http://localhost:1234/public.6efbc4f8.js:163:3\n', message: "Network Error", name: "AxiosError", code: "ERR_NETWORK", config: {…}, request: XMLHttpRequest }
logger.ts:99:11

I dont understand why the http://localhost:5000/api/api-signup/stage-two-credentials?id=27 is  NS_ERROR_DOM_BAD_URI

backend yii2 config for url Manager:

				[
					'class' => 'yii\rest\UrlRule',
					'controller' => ['api-signup'],
					'prefix' => 'api',
					// Note: To use versioning for the API: 'prefix' => 'api/v1',
					'pluralize' => false,
					'extraPatterns' => [
						'stage-two-credentials/<id:\d+>' => 'stage-two-credentials',
						// ... code...
					],
				]
				
final class ApiSignupController extends ApiBaseController
{
	public function behaviors(): array
	{
		$behaviors = parent::behaviors();
		
		/**
		* CORS Filter
		* - Override allowed HTTP methods for CORS preflight specifically for UserController
		*/
		$behaviors['corsFilter']['cors']['Access-Control-Request-Method'] = ['GET', 'POST'];
		
		/**
		* Authenticator Filter
		* - Extend 'except' so signup and reset-password actions do not require auth
		* - Ensure uniqueness after merge in case of duplicates
		*/
		$behaviors['authenticator']['except'] = array_merge(
			$behaviors['authenticator']['except'], [
				'stage-one-email',
				'stage-one-verify',
				'stage-two-credentials',
				'business-categories',
			]
		);
		$behaviors['authenticator']['except'] = array_unique(
			$behaviors['authenticator']['except']
		);
		
		/**
		* Verb Filter
		* @url https://www.yiiframework.com/doc/guide/2.0/en/structure-filters#verb-filter
		*/
		$behaviors['verbFilter'] =
		[
			'class' => VerbFilter::class,
			'actions' =>
			[
				'stage-one-email' => ['POST', 'OPTIONS'],
				'stage-one-verify' => ['POST', 'OPTIONS'],
				'stage-two-credentials' => ['POST', 'OPTIONS'],
				'stage-three-category' => ['POST', 'OPTIONS'],
				'stage-four-business-name' => ['POST', 'OPTIONS'],
				'stage-five-description' => ['POST', 'OPTIONS'],
				'stage-six-contact-details' => ['POST', 'OPTIONS'],
				'stage-seven-business-card' => ['POST', 'OPTIONS'],
				'stage-eight-business-pictures' => ['POST', 'OPTIONS'],
				'stage-nine-confirm' => ['POST', 'OPTIONS'],
				'business-categories' => ['GET', 'OPTIONS'],
			],
		];
		
		return $behaviors;
	}

	public function actionStageTwoCredentials(int $id): array
	{
		$request = \Yii::$app->request;
		if (!$request->isPost)
		{
			throw new YiiBadRequestHttpException('Only POST requests are allowed.');
		}
		//\Yii::error("Request Post: " . json_encode($request->post()), __METHOD__);
		
		$model = new SignupStageTwoForm($id);
		if (!($model->load($request->post(), '') && $model->validate()))
		{
			return [
				'success' => false,
				'message' => $form->getFirstErrors(),
				'errors'  => $model->getErrors()
			];
		}
		
		// @return bool - Perform the post-validation action.
		if (!$model->process())
		{
			return [
				'success' => false,
				'message' => 'Failed to save user credentials',
				'errors'  => $model->getErrors(),
			];
		}
		
		return [
			'success' => true,
			'status' => 'success',
			'message' => 'Email address successfully verified.',
			
		];
	}
}

class ApiBaseController extends Controller
{
	public $enableCsrfValidation = true;
	
	public function behaviors(): array
	{
		$behaviors = parent::behaviors();
		
		$behaviors['corsFilter'] =
		[
			'class' => Cors::class,
			'cors' => [
				// Allowed request origins - set via env variable or fallback default
				'Origin' => $this->getAllowedOrigins(),
				
				'Access-Control-Allow-Headers' => ['Content-Type', 'Authorization', 'X-Requested-With', 'X-CSRF-Token'],
				'Access-Control-Expose-Headers' => ['X-CSRF-Token'],
				
				// Allow credentials (cookies, HTTP auth, etc.) in requests
				'Access-Control-Allow-Credentials' => true,
				
				// Preflight OPTIONS request cache duration (seconds)
				'Access-Control-Max-Age' => 3600,
			],
		];
		
		$behaviors['contentNegotiator'] =
		[
			'class' => ContentNegotiator::class,
			'formats' => [
				'application/json' => Response::FORMAT_JSON,
			],
		];
		
		$behaviors['authenticator'] =
		[
			'class' => HttpBearerAuth::class,
			'except' => ['options'],// Allow unauthenticated access to these actions
		];
		
		return $behaviors;
	}
	
	public function beforeAction($action)
	{
		if (!parent::beforeAction($action))
		{
			return false;
		}
		
		$request = \Yii::$app->request;
		if (in_array($request->method, ['POST', 'PUT', 'PATCH']))
		{
			$token = $request->headers->get('X-CSRF-Token');
			if (!$token)
			{
				$params = $request->getBodyParams();
				$token = $params[$request->csrfParam] ?? null;
			}
			
			if (!$request->validateCsrfToken($token))
			{
				throw new \yii\web\BadRequestHttpException('Invalid CSRF token.');
			}
		}
		
		return true;
	}
	
	public function actions()
	{
		return [
			'options' => [
				'class' => 'yii\rest\OptionsAction',
			],
		];
	}
}