Hapi not adding cors header in response even after adding Access-Control-Allow-Origin: *

routes.js

const routes = [
    {
        method: 'get',
        path: '/',
        handler: (request, hapi) => {
            const response = hapi.response({
                status: 'success',
            })

            return response
        },
    },
]

module.exports = routes

server.js

const Hapi = require('@hapi/hapi')
const routes = require('./routes')

const init = async () => {
    const server = Hapi.server({
        port: 5000,
        host: 'localhost',
        routes: {
            cors: true,
        },
    })

    await server.start()

    server.route(routes)
}

init()

hapi not add Access-Control-Allow-Origin: * in response header

browser

Access to fetch at 'http://localhost:5000/notes' from origin 'url' has been blocked by CORS policy: The request client is not a secure context and the resource is in more-private address space local.

I add

response.header('Access-Control-Allow-Origin', '*')

still no cors header in response header