title: What are the security implications of setting Access-Control-Allow-Headers: *, if any?
body: <p>For my web app, I sometimes get errors like <code>Request header field Pragma is not allowed by Access-Control-Allow-Headers in preflight response</code>, which I can solve by configuring <code>Access-Control-Allow-Headers: *</code> on the server side.</p>
  <p>Are there any security implications for doing this?</p>