$wgAllowedCorsHeaders = [
/* simple headers (see spec) */
'Accept',
'Accept-Language',
'Content-Language',
'Content-Type',
/* non-authorable headers in XHR, which are however requested by some UAs */
'Accept-Encoding',
'DNT',
'Origin',
/* MediaWiki whitelist */
'User-Agent',
'Api-User-Agent',
/* Allowing caching preflight requests, see T269636 */
'Access-Control-Max-Age',
];
$wgAllowedCorsHeaders = [
/* simple headers (see spec) */
'Accept',
'Accept-Language',
'Content-Language',
'Content-Type',
/* non-authorable headers in XHR, which are however requested by some UAs */
'Accept-Encoding',
'DNT',
'Origin',
/* MediaWiki whitelist */
'User-Agent',
'Api-User-Agent',
];