How is the cross-domain implementation of CROS OPTIONS?

read about CROS on the Internet, probably understand the flow of non-simple requests.
first Options the request, and then after the negotiation is successful, after the formal request.

nothing can be done. Do a hand-holding party
I customized two values in header for verification.

the browser reports the following cross-domain problems.

: http://111.231.56.227:12084/monitor/detailMission : CORS  CORS  "Access-Control-Allow-Headers"  "appid"

JS Code

    var form = new FormData();
    form.append("mission_id", "245d14793c0e4f4fa936755cd558841a");

    var settings = {
        "async": true,
        "crossDomain": true,
        "url": "http://111.231.56.227:12084/monitor/detailMission",
        "method": "POST",
        "headers": {
            "appId": "0000815",
            "appSecret": "cbd88ab8822fa",
        },
        "processData": false,
        "contentType": false,
        "mimeType": "multipart/form-data",
        "data": form
    };

    $.ajax(settings).done(function (response) {
        console.log(response);
    });

PHP Action

        header("Content-type: application/json");
        header("Access-Control-Allow-Origin:*");

        if ($_SERVER["REQUEST_METHOD"] == "OPTIONS"){
            header("Access-Control-Allow-Methods:POST");
            header("Access-Control-Allow-Headers:*");
            header("Access-Control-Mas-Age:3600");
            $this->returnSuccess();
        }
        $this->checkAppIdAndSecret();
        $id = $this->getPost("mission_id");

people say that headers cannot be used *, so they change it

header("Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, appid, appSecret");

MethodsOPTIOHSGETPUT