where do you configure Access-Control-Allow-Origin

it turns out that my cors middleware is misplaced and written behind the static resource middleware, so that cors will not be executed after matching the picture.

cors middleware should be written in front of static resource middleware