CORS Response Header

I am using this plugin for images (api.domain.com) which gets used by the frontend at (domain.com). If I want to load the image with XMLHttpRequest e.b. axios.get(..) there is no Access-Control-Allow-Origin header in the response.

On the strapi side I have a config/middleware.js with the following content:

module.exports = {
  settings: {
    cors: {
      enabled: true,
      origin: ['http://domain.com'],
    },
  },
};

Is there anything missing to get it working?