Why are cross-origin POST requests with Content-Type 'application/json' considered to be unsafe?
According to https://javascript.info/fetch-crossorigin#unsafe-requests Safe headers – the only allowed custom headers are: ... Content-Type with the value application/x-www-form-urlencoded, multipart/form-data or text/plain. If I understand the consequences correctly: Sending a cross origin POST request with Content-Type header appliation/json will first trigger…