access-control-allow-headers: * is being ignored [duplicate]
问题 This question already has an answer here : Missing token in CORS header ‘Access-Control-Allow-Headers’ from CORS preflight channel (1 answer) Closed 8 months ago . Although the OPTIONS returns * for Allow-Headers I'm getting the following CORS response. Access to XMLHttpRequest at 'https://example1.com' from origin 'https://example2.net' has been blocked by CORS policy: Request header field x-requested-with is not allowed by Access-Control-Allow-Headers in preflight response. While the OPTION