but under CORS_ALLOW_HEADERS
# general
f
but under CORS_ALLOW_HEADERS