Function default_response_headers 

pub fn default_response_headers(
    request_headers: &HeaderMap,
    cors_allow_credentials_origins: &[String],
) -> HeaderMap

default response headers key-value pairs.

cors_allow_credentials_origins is RFC 067’s [service].cors_allow_credentials_origins — exact origin strings (beyond the implicitly-allowed loopback ones, see is_credentialed_reflection_allowed — private to this crate, not linked here since rustdoc’s public docs can’t resolve a private item) allowed credentialed reflection. Empty for a caller that has no config in scope (e.g. a fixed 204 preflight built with no request context) — degrading to the safe, non-credentialed path is correct there, never the reverse.