I am wondering if this header is added by Axios or if it is added by the browser... to see if I can disable it in the client or must add support for it in the server.

I added a custom token x-access-token and I'm having CORS issues.

CodePudding user response：

Adding to Jon's comment: The Access-Control-Request-Headers header is added by the browser: When the client application desires to make a request (via fetch or XMLHttpRequest) that includes a "non-standard" header like x-access-token, the browser first makes a preflight request with a header like Access-Control-Request-Headers: x-access-token, and only if the preflight response contains Access-Control-Allow-Headers: x-access-token will it make the desired request.

It is your server's duty to produce the correct preflight response.