you still need to allow this header in CORS config...

# ktor

[cy]

you still need to allow this header in CORS config even it is not actually used but listed in Access-Control-Request-Headers, yes