Default HTTP headers that are always allowed by CORS (simple request headers according to https://www.w3.org/TR/cors/#simple-header ) Please note that Content-Type header simplicity depends on it's value.
Default HTTP headers that are always allowed by CORS to be used in response (simple request headers according to https://www.w3.org/TR/cors/#simple-header )