一个奇怪现象，curl发送的请求header可以突破服务器限制？?报错

调试代码的过程中发现了一个奇怪的现象。

我用fetch向后台发出post请求:

fetch("http://localhost:8080/note/create",{
	headers: { "Accept":"application/json", 'Content-Type':'application/json'},
       mode:'cors',
       method:"POST",
            body:JSON.stringify({completed:false,message:"erw11111111"}),
        })

Fetch API cannot load http://localhost:8080/note/create. Request header field content-type is not allowed by Access-Control-Allow-Headers in preflight response.

response.setHeader("Access-Control-Allow-Headers", "x-requested-with");

改为

response.setHeader("Access-Control-Allow-Headers", "Content-Type,Accept");

就好了。

但我发现，如果用curl的话，哪怕reponse header不变，curl也能强行把post请求提交上去，非常霸道：

curl -H "Accept: application/json" -H "Content-type: application/json" -X POST -d '{"message":"value"}' http://localhost:8080/note/create