Q:

How do I add a 'Access-Control-Allow-Origin' to a requested resource with a custom scheme with CefSharp

Using a XMLHttpRequest which is the subject of my previous question with a custom scheme I am loading local files.  To test I used the disable-web-security argument but I do not want to use the browser with this disabled.
Once disable-web-security is enabled then I get 

No 'Access-Control-Allow-Origin' header is present on the requested resource.

How (or where) can I add this to the header or otherwise fix it.
First I have tried to use the AddCrossOriginWhitelistEntry but I do not know what to put in.  My Scheme is test:// and I call for example test://local/folder/3Markets.xlsx.  The webpage origin is https://product.company.de
CefSharp.Cef.AddCrossOriginWhitelistEntry("test://local", "test", "product.company.de", True)

and this
CefSharp.Cef.AddCrossOriginWhitelistEntry("test://local", "test", "", True)

But honestly I don't understand what I am supposed to put here.
I also thought that I can fix this issue with my custom scheme handling.
Dim cs As New CefCustomScheme With {
        .SchemeName = DBSchemeHandler.DBSchemeName,
        .SchemeHandlerFactory = New DBSchemeHandler,
        .IsStandard = True,   'DONT THINK THIS IS NEEDED
        .IsCorsEnabled = True   'DONT THINK THIS IS NEEDED
    }
    dbSurferSettings.RegisterScheme(cs)

I thought in the response I would need to add this header. Or is it the request?
Public Overrides Function GetResponse(response As IResponse, ByRef responseLength As Long, ByRef redirectUrl As String) As Stream

Dim aURI As New Uri(response)
Dim fileName As String = aURI.AbsolutePath

Dim bytes As Byte() = File.ReadAllBytes(fileName)
Dim mStream = New MemoryStream(bytes)

If mStream Is Nothing Then
    Return Nothing
Else
    Stream = mStream
    Stream.Position = 0
    responseLength = Stream.Length
    Dim fileExtension = Path.GetExtension(fileName)
    MimeType = GetMimeType(fileExtension)
    StatusCode = CInt(HttpStatusCode.OK)
    response.Headers.Add("Access-Control-Allow-Origin", "*")
    Return mStream
End If
End Function

A:

For anyone reviewing this. Amaitland's comments have corrected my issues.
The domain of the website is https://product.company.de and my scheme is test.  Thus one way is as follow.
CefSharp.Cef.AddCrossOriginWhitelistEntry("https://product.company.de", "test", "", True)

Also the other thing I was doing incorrectly is I was adding this at application start up.  But it was returning false.  You need to add this once the browser is actually on the website with in my example https://product.company.de. Setting it with all the other settings at startup means it returns falls.  I have put it into the FrameLoadEnd event.

