Allow CORS for webroot files!

I need to fetch and download files from webroot/datafiles/images/filename.jpg, but I got CORS error!

The download works when the link is opened through navigator (not fetch http)

ERROR Access to XMLHttpRequest at ‘http://159.89.93.8/datafiles/arquivos/01dadd40-cd06-11ea-bf2e-7384e360a612.jpeg?ignoreInterceptor=true’ from origin ‘http://localhost:8080’ has been blocked by CORS policy: Request header field access-control-allow-origin is not allowed by Access-Control-Allow-Headers in preflight response.

export function download(file: File) {
  return api.get(normalizeFileUrl(file.name), {
    responseType: 'blob',
  }).then(response => {
    FileDownload(response, `${file.nome}`);
  });
}

I’m using cakephp as API it’s already configured CORS!