electron/chrome reporting outdated cors headers from node.js

A bit of background...I was trying to connect 2 computers on my local network to each other, a React Client on a windows desktop to a Node.js server on mac laptop. To get this working, I had to change CORS settings in Node.js on the mac to allow for requests from a specific IP address, the IP of the windows machine running the React Client.

Long story short, after running those tests I changed the CORS settings back to only accept connections from localhost on the mac laptop, which was originally running the node.js server, so I could continue to develop both the client & server on the mac machine. Despite making this change, I am still seeing an error in the electron console "Access to XMLHttpRequest at 'http://localhost:9000/auth' from origin 'http://localhost:3000' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'http://{ip of windows machine}:3000' that is not equal to the supplied origin." I do not get the same error when I open the react application in Chrome instead of in electron.

What might be going on here? How Can I debug this?

My cors code on the server is as follows:

app.use((req, res, next) => {
  const whitelist = [
    process.env.CLIENT_URL,
    'http://127.0.0.1:3000',
    'http://127.0.0.1:9000',
    'http://localhost:3000',
    'http://localhost:9000',
  ];
  let reqOrigin = req.get('origin');
  let origin = process.env.CLIENT_URL;
  if (whitelist.includes(reqOrigin)) {
    origin = reqOrigin;
  }
  res.setHeader('Access-Control-Allow-Origin', origin);
  // set this to true to allow cookies to be sent in.
  res.setHeader('Access-Control-Allow-Credentials', 'true');
  // set which methods are allowed from outside
  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE');
  // set which headers are allowed
  res.setHeader(
    'Access-Control-Allow-Headers',
    'Content-Type, Authorization, Content-Security-Policy'
  );
  next();
});

the CLIENT_URL environment variable getting passed in here is set to 'http://' + config.CLIENT_BASE + ':' + config.CLIENT_PORT which gets passed in when the server is started as a child process from the main electron process, and there is a .env file where CLIENT_BASE is set to "localhost" and CLIENT_PORT is set to 3000. It seems like the CLIENT_BASE value is not updating to localhost, as if it's stuck as the value of the IP of the other machine?

is there some kind of port-based or url-based cache which is not clearing somewhere on the device? or, is there something else I am not thinking of? restarting the device did not fix the issue, however changing the PORT numbers of both the client and server in the .env file does fix it...so it seems as if those ports, 3000 & 9000 are still blocked, even a couple of days later. It's as if node.js/electron still only expects to receive requests from the windows machine even though i have changed that environment variable back to "localhost". At a bit of a loss at this point.

I guess the real question is, where would that old CORS IP address setting be coming into the program from if it's not in any of the .env files, not stored in a variable anywhere in the program? Please let me know if there's any other info which might be helpful. Any ideas would be appreciated. Thanks!

edit: haven't had the chance to test this yet, but i, for other reasons, ended up disabling the http-cache app.commandLine.appendSwitch ("disable-http-cache"); in electron. I wonder if this has anything to do with it? will report back if i find the time to test