Drop Origin & Accept from Access-Control-Allow-Headers value

changelog.d/10114.misc

@@ -0,0 +1 @@
+Drop Origin and Accept from the value of the Access-Control-Allow-Headers response header.

synapse/http/server.py

@@ -728,7 +728,7 @@ def set_cors_headers(request: Request):
     )
     request.setHeader(
         b"Access-Control-Allow-Headers",
-        b"Origin, X-Requested-With, Content-Type, Accept, Authorization, Date",
+        b"X-Requested-With, Content-Type, Authorization, Date",
     )