diff --git a/nginx/default.conf b/nginx/default.conf
index d8493a16..52ba2595 100644
--- a/nginx/default.conf
+++ b/nginx/default.conf
@@ -24,6 +24,10 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_ssl_verify off;
+        
+        # CORS headers
+        add_header Access-Control-Allow-Origin $http_origin always;
+        add_header Access-Control-Allow-Credentials true always;
     }
 
     location ~ ^/([^/]+)/priv/(.*) {
@@ -33,38 +37,88 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_ssl_verify off;
+        
+        # CORS headers
+        add_header Access-Control-Allow-Origin $http_origin always;
+        add_header Access-Control-Allow-Credentials true always;
+        add_header Access-Control-Expose-Headers X-Redirect-Location always;
     }
 
     location ~ ^/[^/]+/(tmp|ilx)_.*\.(html|ttl|jsonld|n3|owl|csv)$ {
-        proxy_pass https://uri.olympiangods.org$request_uri;
-        proxy_set_header Host $host;
+        proxy_pass https://uri.olympiangods.org;
+        proxy_set_header Host uri.olympiangods.org;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_ssl_verify off;
+        
+        # CORS headers
+        add_header Access-Control-Allow-Origin $http_origin always;
+        add_header Access-Control-Allow-Credentials true always;
+    }
 
+    location ~ ^/[^/]+/ontologies/uris/.*\.(html|jsonld)$ {
+        proxy_pass https://uri.olympiangods.org;
+        proxy_set_header Host uri.olympiangods.org;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_ssl_verify off;
+        
         # CORS headers
         add_header Access-Control-Allow-Origin $http_origin always;
         add_header Access-Control-Allow-Credentials true always;
     }
 
     location ~ ^/[^/]+/ontologies/uris/.*/spec$ {
-        proxy_pass https://uri.olympiangods.org$request_uri;
-        proxy_set_header Host $host;
+        proxy_pass https://uri.olympiangods.org;
+        proxy_set_header Host uri.olympiangods.org;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
-
-        # Forward Authorization header if present
         proxy_set_header Authorization $http_authorization;
-
+        proxy_ssl_verify off;
+        
+        # Handle 303 redirects
+        proxy_intercept_errors on;
+        error_page 303 = @handle_303;
+        
         # CORS headers
         add_header Access-Control-Allow-Origin $http_origin always;
         add_header Access-Control-Allow-Credentials true always;
         add_header Access-Control-Expose-Headers X-Redirect-Location always;
+    }
 
-        # Handle 303 redirects: move Location to X-Redirect-Location
-        proxy_intercept_errors on;
-        error_page 303 = @handle_303;
+    location ~ ^/[^/]+/[^/]+/versions$ {
+        proxy_pass https://uri.olympiangods.org;
+        proxy_set_header Host uri.olympiangods.org;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_ssl_verify off;
+        
+        # CORS headers
+        add_header Access-Control-Allow-Origin $http_origin always;
+        add_header Access-Control-Allow-Credentials true always;
+    }
+
+    # Handle 303 redirects for spec endpoint
+    location @handle_303 {
+        internal;
+        proxy_pass https://uri.olympiangods.org;
+        proxy_set_header Host uri.olympiangods.org;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Authorization $http_authorization;
+        proxy_ssl_verify off;
+        
+        # Move Location header to X-Redirect-Location
+        proxy_hide_header Location;
+        add_header X-Redirect-Location $upstream_http_location always;
+        add_header Access-Control-Allow-Origin $http_origin always;
+        add_header Access-Control-Allow-Credentials true always;
+        add_header Access-Control-Expose-Headers X-Redirect-Location always;
     }
 
     location /static/ {
diff --git a/src/components/Auth/Login.jsx b/src/components/Auth/Login.jsx
index 2c6bac1e..07dc73f8 100644
--- a/src/components/Auth/Login.jsx
+++ b/src/components/Auth/Login.jsx
@@ -50,13 +50,13 @@ const Login = () => {
       const { code, cookies, groupname } = e.data;
       if (code === 200 || code === 302) {
         const _cookies = JSON.parse(cookies);
-        const sessionCookie = _cookies.find(cookie => cookie.name === "session");
+        const sessionCookie = _cookies && Object.prototype.hasOwnProperty.call(_cookies, 'session') ? _cookies['session'] : undefined;
         let expires = new Date()
         if (sessionCookie && (existingCookies['session'] === undefined)) {
           expires.setTime(expires.getTime() + (2 * 24 * 60 * 60 * 1000)); // 2 days
           setCookie(
             'session',
-            sessionCookie.value,
+            sessionCookie,
             {
               path: '/',
               secure: false,
@@ -79,10 +79,10 @@ const Login = () => {
           localStorage.setItem(API_CONFIG.SESSION_DATA.SETTINGS, JSON.stringify(userData));
           localStorage.setItem(API_CONFIG.SESSION_DATA.COOKIE, JSON.stringify({
             name: 'session',
-            value: sessionCookie.value,
+            value: sessionCookie,
             expires: expires
           }));
-          localStorage.setItem("token", sessionCookie.value)
+          localStorage.setItem("token", sessionCookie)
           setUserData({
             name: userData['groupname'],
             id: userData['orcid'],
diff --git a/vite.config.js b/vite.config.js
index 41829e13..d8ee02cf 100644
--- a/vite.config.js
+++ b/vite.config.js
@@ -63,7 +63,6 @@ export default defineConfig({
             console.log('Received Response from the Target:', proxyRes.statusCode, req.url);
             const location = proxyRes.headers['location'];
             console.log('Received location', location);
-          
             if (proxyRes.statusCode === 303 && location) {
               // Prevent browser from seeing the actual Location
               delete proxyRes.headers['location'];
@@ -79,7 +78,6 @@ export default defineConfig({
             res.setHeader('Access-Control-Allow-Credentials', 'true');
             res.setHeader('Access-Control-Expose-Headers', 'X-Redirect-Location');
           });
-                
         },
       },
       '^/[^/]+/(tmp|ilx)_.*\\.(html|ttl|jsonld|n3|owl|csv)$': {
@@ -123,13 +121,11 @@ export default defineConfig({
               proxyReq.setHeader('Authorization', req.headers.authorization);
             }
           });
-      
           proxy.on('proxyRes', (proxyRes, req, res) => {
             const location = proxyRes.headers['location'];
           
             if (proxyRes.statusCode === 303 && location) {
               delete proxyRes.headers['location'];
-              res.statusCode = 200; // Prevent browser redirect
               res.setHeader('X-Redirect-Location', location);
               res.setHeader('Access-Control-Allow-Origin', req.headers.origin || '*');
               res.setHeader('Access-Control-Allow-Credentials', 'true');
@@ -148,6 +144,21 @@ export default defineConfig({
             res.setHeader('Access-Control-Expose-Headers', 'X-Redirect-Location');
           });
         },
+      },
+      '^/[^/]+/[^/]+/versions$': {
+        target: 'https://uri.olympiangods.org',
+        changeOrigin: true,
+        secure: false,
+        rewrite: path => path, // Keep full path
+        configure: (proxy) => {
+          proxy.on('proxyRes', (proxyRes, req, res) => {
+            const origin = req.headers.origin;
+            if (origin) {
+              res.setHeader('Access-Control-Allow-Origin', origin);
+            }
+            res.setHeader('Access-Control-Allow-Credentials', 'true');
+          });
+        },
       }
     },
   },