diff --git a/src/main/java/com/alist/api/config/filter/DynamicCorsFilter.java b/src/main/java/com/alist/api/config/filter/DynamicCorsFilter.java
index 065025f..556afd8 100644
--- a/src/main/java/com/alist/api/config/filter/DynamicCorsFilter.java
+++ b/src/main/java/com/alist/api/config/filter/DynamicCorsFilter.java
@@ -69,7 +69,7 @@ public class DynamicCorsFilter extends OncePerRequestFilter {
             response.setHeader("Access-Control-Allow-Origin", origin);
             response.setHeader("Access-Control-Allow-Credentials", "true");
             response.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, PATCH, OPTIONS");
-            response.setHeader("Access-Control-Allow-Headers", "*");
+            response.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-Requested-With");
             response.setHeader("Access-Control-Expose-Headers", "Authorization, Set-Cookie");
             response.setHeader("Access-Control-Max-Age", "3600");
         }