请求没有“Access Control Allow Origin”标头仅在请求后才出现在请求的资源上

我很抱歉问这个问题,但我处理cakephp3.x只有2天,我看不出有什么问题。 middleware 方法,我还应该怎么做?这是激活CORS域的正确方法吗?

Application.php
  ->add(function($request, $response, $next) {
            return $next($request, $response)
                ->withHeader('Access-Control-Allow-Origin', '*')
                ->withHeader('Access-Control-Allow-Methods', '*')             
                ->withHeader('Access-Control-Allow-Credentials', 'true')
                ->withHeader('Access-Control-Allow-Headers', 'X-Requested-With')
                ->withHeader('Access-Control-Allow-Headers', 'Content-Type')
                ->withHeader('Access-Control-Allow-Type', 'application/json');
        });