CORS
Access-Control-Allow-Headers
Specifies which HTTP headers can be used in the actual request following a CORS preflight.
Syntax
Access-Control-Allow-Headers: <header-name>, <header-name>Example
Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-WithDescription
Access-Control-Allow-Headers indicates which headers can be included in cross-origin requests.
Simple headers (Accept, Accept-Language, Content-Language, simple Content-Type) are always allowed. Custom headers like Authorization need explicit permission.
* allows any headers but does not work with credentials.
How real sites send this header
Home-page responses of 503 popular sites from the enterno.io /check catalogue, checked in the last 30 days.
3.6%
(18 of 503) send Access-Control-Allow-Headers.
Most common values:
*— 5 sitesContent-Type, Authorization— 2 sites
See it on: activecampaign.com, yclients.com, crisp.chat, dbt.io, lightstep.com
Check if your website sends this header correctly
Check your headers →