如果你是一个停止间隙的解决方案，只是为了调试，您可以使用标记在chrome中关闭它。

If you're after a stop gap solution, just for debugging, you can use a flag to turn it off in chrome.

[chromium executable] --disable-web-security

这取自这篇文章 Chrome：禁用相同的原始政策。

否则，响应中的添加标题是正确的去。当然，如果您想提高安全性，您可以将星号替换为IP地址列表。

Otherwise, the addition header in the response is the right way to go. Of course, you can swap the asterisk for a list of IP addresses if you want to improve security.

请参阅 https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS 了解详情。