ingress-nginx: cors settting not working for me

ingress config:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: {{ .Values.fullnameOverride }}
  annotations:
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/cors-allow-origin: "*"
spec:
  ingressClassName: nginx
  rules:
    - host: {{ .Values.ingress.host }}
      http:
        paths:
          - pathType: Prefix
            path: /
            backend:
              service:
                name:  {{ .Values.fullnameOverride }}
                port:
                  number: 80

but browser show me cors error: Access to XMLHttpRequest at ‘http://gm.simplethai.t.petaplay.com/user_mgr/userInfo?uid=100001&num=859467525&sig=fb38805d4c9296d7eb42cdea638e6f1e&operator=martin&防御=防御&_=1637648601216’ from origin ‘http://simplethai.admin.t.petaplay.com’ has been blocked by CORS policy: The request client is not a secure context and the resource is in more-private address space private.

i am confirmed config is correct ,and i exec nginx pod ,check nginx.conf:

if ($request_method = 'OPTIONS') {                                                                                     
                                more_set_headers 'Access-Control-Allow-Origin: *';                                                             
                                more_set_headers 'Access-Control-Allow-Credentials: true';                                                     
                                more_set_headers 'Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS';                       
                                more_set_headers 'Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization';
                                                                                                                                                                                                      
                                more_set_headers 'Access-Control-Max-Age: 1728000';                                                                                                                   
                                more_set_headers 'Content-Type: text/plain charset=UTF-8';                                                                                                            
                                more_set_headers 'Content-Length: 0';                                                                                                                                 
                                return 204;                                                                                                                                                           
                        }                                                                                                                                                                             
                                                                                                                                                                                                      
                        more_set_headers 'Access-Control-Allow-Origin: *';                                                                                                                            
                        more_set_headers 'Access-Control-Allow-Credentials: true';

someone can help me ?