which 1) they shouldn’t be doing but 2) is that so...

# ktor

[joshua.ewer]

which 1) they shouldn’t be doing but 2) is that something you’d want ktor to 403 on? if you read the spec strictly header indicates which headers will be used in the actual request as part of the preflight request i could see where #2 could be true