Cors in cakephp 3.6

I am using cors for my app with Cakephp 3.6
I am writing this in AppContoller.php
So that all my API is allowed on other host requests.
use Cake\Event\Event;
use App\Model\Entity\Users as UsersEntity;
use Cake\Http;
use Cake\Http\CorsBuilder;

public function beforeFilter(Event $event)
             ->allowMethods(['GET', 'POST'])


Is this Correct ? Then why this is not working?

did you resolved this?

The response instance is immutable so you need to assign back the modified response instance to $this->response.