Access-Control-Allow-Headers

The request headers a cross-origin request may send, answering a preflight.

Header name, or pasted headers

Explained

Examples

Example

Access-Control-Allow-Headers: Content-Type, Authorization

Sending Authorization or Content-Type: application/json cross-origin triggers a preflight, and this header must list them.

Defined in Fetch standard, CORS protocol.