你会得到一个CORS预检。这是一个使用HTTP OPTIONS 动词的请求，并包含多个标头，其中之一是 Access-Control-Request-Headers 列出客户希望包含在请求中的标头。

When you start playing around with custom request headers you will get a CORS preflight. This is a request that uses the HTTP OPTIONS verb and includes several headers, one of which being Access-Control-Request-Headers listing the headers the client wants to include in the request.

您需要使用适当的CORS标头来回复CORS预检，以使其工作。其中之一确实是 Access-Control-Allow-Headers 。该标头需要包含 Access-Control-Request-Headers 标头包含的（或更多）相同的值。

You need to reply to that CORS preflight with the appropriate CORS headers to make this work. One of which is indeed Access-Control-Allow-Headers. That header needs to contain the same values the Access-Control-Request-Headers header contained (or more).

https://fetch.spec.whatwg.org/#http-cors-protocol 说明此设置更详细。