Access-Control-Allow-Headers
Request headers a cross-origin page may send.
Response header (sent by servers) cors
How it works
Answer to a preflight that listed headers in Access-Control-Request-Headers.
Example
Access-Control-Allow-Headers: Authorization, Content-Type
See it live: send any request in Endpoint Client and open the Headers tab, where every response header is explained. Specification: Fetch Standard.
Related headers
Access-Control-Allow-Credentials
Whether the browser may expose the response when the request carried cookies or auth.
Access-Control-Allow-Methods
Methods a cross-origin page may use.
Access-Control-Allow-Origin
Which web origin may read this response from browser JavaScript.
Access-Control-Expose-Headers
Response headers that cross-origin JavaScript may read.
Access-Control-Max-Age
How long the browser may cache a preflight result, in seconds.
Origin
The web origin that initiated the request.