https://github.com/koajs/cors/blob/master/index.js#L138

I got it ：https://github.com/koajs/cors/blob/master/index.js#L138

_Originally posted by @slip-box in https://github.com/koajs/cors/issues/71#issuecomment-654097447_

allowHeaders don't proxy custom headers [1] to koa middleware. [2]

**[1]**
``` typescript
server.applyMiddleware({
app,
cors: {
allowHeaders: ['authorization'],
},
})
```

**[2]**
``` typescript
export const app = new Koa()
app.use(async (ctx, next) => {
ctx.req.headers.authorization // this is undefined
})
```

Start at index.js around line 138 and trace how the allowHeaders option reaches the Koa middleware. Reproduce the example with the authorization header, then verify that custom headers are available through ctx.req.headers; add regression coverage for the reported behavior if the repository's existing tests provide a suitable entry point.

Written by the indexing model from the issue text.