在rails应用程序中，我应该在哪里应用“Access-Control-Allow-Origin”头

class ApplicationController < ActionController::Base
  before_action :set_access_control_headers

  private

  def set_access_control_headers
    headers['Access-Control-Allow-Origin'] = 'http://example.com' # 允许访问的域
    headers['Access-Control-Allow-Methods'] = 'GET, POST, PUT, DELETE' # 允许的HTTP方法
    headers['Access-Control-Allow-Headers'] = 'Content-Type' # 允许的请求头
    headers['Access-Control-Max-Age'] = '3600' # 预检请求的有效期
  end
end

config.action_dispatch.default_headers = {
  'Access-Control-Allow-Origin' => 'http://example.com',
  'Access-Control-Allow-Methods' => 'GET, POST, PUT, DELETE',
  'Access-Control-Allow-Headers' => 'Content-Type',
  'Access-Control-Max-Age' => '3600'
}