[horsawlarway]

If you're genuinely interested, MDN has some pretty great documentation on the subject.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

For your specific question, this is the relevant section of the above link

----

Apart from the headers automatically set by the user agent (for example, Connection, User-Agent, or the other headers defined in the Fetch spec as a “forbidden header name”), the only headers which are allowed to be manually set are those which the Fetch spec defines as a “CORS-safelisted request-header”, which are:

Accept

Accept-Language

Content-Language

Content-Type (but note the additional requirements below)