我的方法使用了CrossOriginFilter，还是报跨域的错误。

    @POST
    @Filters(@By(type= CrossOriginFilter.class, args={"*", "get, post, put, delete, options", "origin, content-type, accept, appid, token", "true"}))
    @AdaptBy(type=JsonAdaptor.class)
    @At("/products")
    @Ok("json:full")
    public Result getProducts(@Param("insType") String insType, HttpServletRequest req) {
        List<Ins_product> products = getProductsWithChannelRate(insType, "");
        return Result.success("", products);
    }

错误如下：

Access to XMLHttpRequest at 'http://localhost/api/v1/ins/products' from origin 'http://localhost:8088' has been blocked by CORS policy: Request header field appid is not allowed by Access-Control-Allow-Headers in preflight response.

我header里加了appid的呀，为什么没有效果？还需要其他的配置吗？