Listing Origin, DNT, or Accept-Encoding as allowed request headers is never necessary

[jub0bs]

Understanding CORS

• I have read the resources.

Python Version

No response

Django Version

No response

Package Version

No response

Description

The README explicitly lists "accept-encoding", "dnt", and "origin" in the CORS_ALLOW_HEADERS list:

CORS_ALLOW_HEADERS = [
    # omitted
    "accept-encoding",
    # omitted
    "dnt",
    "origin",
    # omitted
]

However, contrary to popular belief and according to the Fetch standard, allowing those request headers is never necessary. As so-called forbidden request headers, they're indeed handled by the browser, not by the client.

You can safely drop those three elements from that list.

[adamchainz]

Thank you for the report. I've removed them in #851.