If you're genuinely interested, MDN has some pretty great documentation on the subject. https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://develope

If you're genuinely interested, MDN has some pretty great documentation on the subject. https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS For your specific question, this is the relevant section of the above link ---- Apart from the headers automatically set by the user agent (for example, Connection, User-Agent, or the other headers defined in the Fetch spec as a “forbidden header name”), the only headers which are allowed to be manually set are those which the Fetch spec defines as a “CORS-safelisted request-header”, which are: Accept Accept-Language Content-Language Content-Type (but note the additional requirements below)