HTTP headers
Access-Control-Allow-Headers HTTP Header Meaning
Access-Control-Allow-Headers lists request headers allowed by a CORS preflight.
Meaning
The server is telling the browser which non-simple request headers may be sent.
Where it appears
Servers send it on preflight OPTIONS responses.
What to check
Check that it covers the requested headers and does not allow sensitive custom headers unnecessarily.
Example
Access-Control-Allow-Headers: Content-Type, Authorization