describe Access-Control-Request-Headers as optional part of preflight

[DinoChiesa]

Description

Describe Access-Control-Request-Headers as an optional part of a preflight request.

Motivation

The current description of a preflight seems to indicate that the Access-Control-Request-Headers header will always be present. But per the fetch spec, that is not the case.

Per
https://fetch.spec.whatwg.org/#cors-preflight-fetch , Access-Control-Request-Headers is an optional part of a preflight. In practice, Chrome v115 does not send Access-Control-Request-Headers when there is no restricted header in the pending outbound request.

Additional details

https://fetch.spec.whatwg.org/#cors-preflight-fetch

specific wording is:

Let headers be the CORS-unsafe request-header names with request’s header list.

If headers is not empty, then:

• Let value be the items in headers separated from each other by ,.

• Append ([Access-Control-Request-Headers](https://fetch.spec.whatwg.org/#http-access-control-request-headers), value) to preflight’s header list.

[github-actions]

Preview URLs

• /en-US/docs/Glossary/Preflight_request

[sideshowbarker]

Dino, thanks much, and congrats on landing your first docs change here — welcome aboard 🎉