How to set custom headers for CORS use?

[devhawk]

I'm trying to add a custom header Attachment-Name to the response returned by an HTTP get triggered azure function (written in typescript, using v4 programming model, running with Azure Functions Core Tools Version: 4.0.5907 and Function Runtime Version: 4.834.3.22875. I have "Host": { "CORS": "*" } set in my local.settings.json file. However, when I call the azure function from the browser, I only get the CORS white listed headers in the browser. I tried setting Access-Control-Allow-Headers manually in my azure function, but that had no effect.

https://github.com/gosqasorg/asset-provenance-tracking/blob/coco-harry-attachment/packages/backend/src/functions/httpTrigger.ts#L175

How do I configure Azure Function Core Tools to allow a custom header to be accessed in a CORS browser request?