Access to from origin ‘null‘ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin‘ heade

Access to XMLHttpRequest at 'http://localhost:8080/postgres/mvt/source/834/428/10' from origin 
'null' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

查看其它成功的请求，发现需要给response header加上这个

response.addHeader("access-control-allow-origin", "*");

@Log
@RestController
@RequestMapping("my")
public class MyController {

    private Connection connection;

    @RequestMapping(value = "source/{x}/{y}/{z}",produces = MediaType.IMAGE_PNG_VALUE)
    public byte[] st_AsMvt(@PathVariable("x") Integer x, @PathVariable("y") Integer y, @PathVariable("z") Integer z,HttpServletResponse response) throws Exception {
        /*...*/
        response.addHeader("access-control-allow-origin", "*");
        return bytes;
    }
}