Consider adding X-Requested-With to default list of AllowedHeaders about cors HOT 3 CLOSED

As this header is added by the browser, as opposed to JS, I would assume the browser won't "ask" for permission before to send it and thus it is not necessary to whitelist it in CORS. Do you have an actual example where not specifically whitelisting this header is an issue?

from cors.

My mistake, I meant to say it is not sent by browsers and is instead set in application JS. So when that application JS sets the header, the browser will add Access-Control-Request-Headers: x-requested-with to the headers of the OPTIONS preflight request.

This header is commonly sent along by default in some frameworks, so yes it's always possible to turn it off. However since I do believe it's fairly common, it might make sense to add it to the defaults here.

It's also totally fine to say "X-Requested-With isn't in the CORS spec, so it's not going to be supported by default".

from cors.

Ok, feel free to send a PR. I don't think it's harmful to add it to the default.

from cors.