I have a SpringBoot project, with a React front-end (Rest Client architecture)

I’m running the React front-end using npm rather than SpringBoot, so I want to allow Cross-Origin requests to avoid the message

client:1 Access to XMLHttpRequest at ‘http://localhost:8081/project/list?short=true’ from origin ‘http://localhost:3000’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource.

In my SpringBoot Rest controller method, I added the following Headers to the Response:

    res.addHeader("Access-Control-Allow-Origin", "*");
    res.addHeader("Access-Control-Allow-Credentials", "true");
    res.addHeader("Access-Control-Max-Age", "1800");
    res.addHeader("Access-Control-Allow-Headers", "content-type");
    res.addHeader( "Access-Control-Allow-Methods", "PUT, POST, GET, DELETE, PATCH, OPTIONS" ); 

Using Postman, I can see that these Headers do now appear in the Response. And yet my Chrome browser still blocks the Request to the API from my Client.
What am I missing?