// http header · cors header
Access-Control-Allow-Headers
Headers allowed in the actual request
What the Access-Control-Allow-Headers header does
Access-Control-Allow-Headers lists which request headers the actual cross-origin request may include, such as Content-Type or Authorization. The browser checks it during preflight before sending custom headers.
Example
Access-Control-Allow-Headers: Content-TypeWhere it's used
Access-Control-Allow-Headers is a cors header. CORS headers govern cross-origin requests — which other origins may read a response.
Other cors headers
Access-Control-Allow-Origin Access-Control-Allow-Methods Access-Control-Allow-Headers Access-Control-Allow-Credentials Access-Control-Max-Age