In a request from Instagram, the URL refers to images or cover of a video post can be seen by adding crossorigin to img tag and it works fine in localhost requests.

<img src="<%= image.thumbnail %>" alt="<%= image.caption %>" title="<%= image.caption %>"
                             class="img-fluid" crossorigin>

But when the web app is called on other devices (even in the same network) gets following error:

these lines were also added to the code but are not working

app.use(function (req, res, next) {
    res.header("Access-Control-Allow-Origin", "https://*.cdninstagram.com/*"); // update to match the domain you will make the request from
    res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
    next();
});