CORS XMLHttpRequest Error on Dspace 9.1

[Timothy Kawulusan]

Please help me, i try anything but not working, already follow the instructions https://wiki.lyrasis.org/display/DSDOC9x/REST+API
but nothing works, get error like this

500:1 Access to XMLHttpRequest at 'https://api-dspace.reformedindonesia.ac.id/server/api' from origin 'https://repository.reformedindonesia.ac.id' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

local.cfg
dspace.ui.url = https://repository.reformedindonesia.ac.id

dspace.server.url = https://api-dspace.reformedindonesia.ac.id/server

Additional URL of DSpace backend which could be used by DSpace frontend during SSR execution.May require a port number if not using standard ports (80 or 443)DO NOT end it with '/'.

dspace.server.ssr.url = ${dspace.server.url}
rest.public.url = ${dspace.server.url}

Public URL of DSpace frontend (Angular UI). May require a port number if not using standard ports (80 or 443)DO NOT end it with '/'.This is used by the backend to provide links in emails, RSS feeds, Sitemaps, etc.NOTE: this URL must be accessible to all DSpace users (should not use 'localhost' in Production).It corresponds to the URL that you would type into your browser to access the User Interface.Name of the site

dspace.name = DSpace - STTRI

Assetstore configurations have moved to config/modules/assetstore.cfgand config/spring/api/bitstore.xml.Additional storage options (e.g. Amazon S3) are available in assetstore.cfgassetstore.dir = ${dspace.dir}/assetstoreDefault language for metadata values

rest.cors.allowed-origins = https://repository.reformedindonesia.ac.id
#default.language = en_US

im using cloudflare to tunnel both backend and frontend, ale

Solr server/webapp.DSpace uses Solr for all search/browse capability (and for usage statistics).Since DSpace 7, SOLR must be installed as a stand-alone service

solr.server = http://90.90.90.10:8983/solr

Solr core name prefix.If you connect multiple instances of DSpace to a single Solr instance, youcan organize them with a common core name prefix.

#solr.multicorePrefix =

usage-statistics.dbfile = /dspace/config/geoip/dbip-city-lite.mmdb

##########################

DATABASE CONFIGURATION

##########################

DSpace ONLY supports PostgreSQL at this time.URL for connecting to database

[DSpace Community]

Hi,

See our "Common Installation Issues" at the bottom of the DSpace 9 installation guide.  It has a section for that "blocked by CORS policy" error with common solutions to that misconfiguration. https://wiki.lyrasis.org/display/DSDOC9x/Installing+DSpace#InstallingDSpace-%22XMLHttpRequest..hasbeenblockedbyCORSpolicy%22or%22CORSerror%22or%22InvalidCORSrequest%22

Tim