Are these Headers required - Access-Control-Allow-Headers?

Question

CORS

Hey everyone,

figuring out CORS - preflight requests: OPTIONS returned, let's say the following

Access-Control-Allow-Headers: "'Content-Type,Authorisation,My-Api-Key,RestricteduserID'"

if subsequent requests to the server, for example GET to some resource, do not contain all these Headers, will a cors error occur? Or are these Headers just recommended?

all the best,
Vadim

Answer 1

The server returns you the allowed request headers, you can not specify them at all or specify them all at once, but if you add a header to the request that the server does not allow, for example, some not-allowed-header, then the server will not accept your request.