您不应该将 Access-Control-Allow-Origin 设置为请求标头，那是响应标头.

You shouldn't be setting Access-Control-Allow-Origin as a request header, that's a response header.

您可以从响应中看到服务器将接受哪些请求标头:

You can see from the response what request headers the server will accept:

Access-Control-Allow-Headers:Origin,Content-Type,Accept

错误消息告诉您:

Request header field Access-Control-Allow-Origin is not allowed

看起来它可能也不接受 X-Requested-With.

It looks like it might not accept X-Requested-With either.