diff --git a/README.md b/README.md
index bfb87663d..ae118f5c5 100644
--- a/README.md
+++ b/README.md
@@ -447,7 +447,7 @@ Most configuration fields are named such that they can be defaulted to falsey. A
 | [overridePageViewDuration](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#overridePageViewDuration) | boolean | false | If true, default behavior of trackPageView is changed to record end of page view duration interval when trackPageView is called. If false and no custom duration is provided to trackPageView, the page view performance is calculated using the navigation timing API. Default is false. |
 | [maxAjaxCallsPerView](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#maxAjaxCallsPerView) | numeric | 500 | Default 500 - controls how many ajax calls will be monitored per page view. Set to -1 to monitor all (unlimited) ajax calls on the page. |
 | [disableDataLossAnalysis](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#disableDataLossAnalysis) | boolean | true | If false, internal telemetry sender buffers will be checked at startup for items not yet sent. |
-| [disableCorrelationHeaders](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#disableCorrelationHeaders) | boolean | false | If false, the SDK will add two headers ('Request-Id' and 'Request-Context') to all dependency requests to correlate them with corresponding requests on the server side. Default is false. |
+| [disableCorrelationHeaders](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#disableCorrelationHeaders) | boolean | false | If true, disable correlation headers on dependency requests. If false, requests must still be allowed by `enableCorsCorrelation`, `correlationHeaderDomains`, `correlationHeaderExcludedDomains` and `correlationHeaderExcludePatterns`. `distributedTracingMode` controls the trace header format, and `Request-Context` is added only when an `appId` is available. |
 | [correlationHeaderExcludedDomains](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#correlationHeaderExcludedDomains) | string[] | undefined | Disable correlation headers for specific domains |
 | [correlationHeaderExcludePatterns](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#correlationHeaderExcludePatterns) | regex[] | undefined | Disable correlation headers using regular expressions |
 | [correlationHeaderDomains](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#correlationHeaderDomains) | string[] | undefined | Enable correlation headers for specific domains |
@@ -466,7 +466,7 @@ Most configuration fields are named such that they can be defaulted to falsey. A
 | [sdkExtension](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#sdkExtension) | string | null | Sets the sdk extension name. Only alphabetic characters are allowed. The extension name is added as a prefix to the 'ai.internal.sdkVersion' tag (e.g. 'ext_javascript:2.0.0'). Default is null. |
 | [isBrowserLinkTrackingEnabled](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#isBrowserLinkTrackingEnabled) | boolean | false | Default is false. If true, the SDK will track all [Browser Link](https://docs.microsoft.com/en-us/aspnet/core/client-side/using-browserlink) requests. |
 | [appId](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#appId) | string | null | AppId is used for the correlation between AJAX dependencies happening on the client-side with the server-side requests. When Beacon API is enabled, it cannot be used automatically, but can be set manually in the configuration. Default is null |
-| [enableCorsCorrelation](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#enableCorsCorrelation) | boolean | false | If true, the SDK will add two headers ('Request-Id' and 'Request-Context') to all CORS requests to correlate outgoing AJAX dependencies with corresponding requests on the server side. Default is false |
+| [enableCorsCorrelation](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#enableCorsCorrelation) | boolean | false | If true, allow correlation headers on requests to other hosts. If false, headers are allowed only when the request host matches the page host. `disableCorrelationHeaders: true` and the domain and URL exclusion settings still take precedence. |
 | [namePrefix](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#namePrefix) | string | undefined | An optional value that will be used as name postfix for localStorage and session cookie name.
 | [sessionCookiePostfix](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#sessionCookiePostfix) | string | undefined | An optional value that will be used as name postfix for session cookie name. If undefined, namePrefix is used as name postfix for session cookie name.
 | [userCookiePostfix](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#userCookiePostfix) | string | undefined | An optional value that will be used as name postfix for user cookie name. If undefined, no postfix is added on user cookie name.
@@ -477,7 +477,7 @@ Most configuration fields are named such that they can be defaulted to falsey. A
 | [enableAjaxPerfTracking](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#enableAjaxPerfTracking) | boolean | false | Default false. Flag to enable looking up and including additional browser window.performance timings in the reported ajax (XHR and fetch) reported metrics.
 | [maxAjaxPerfLookupAttempts](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#maxAjaxPerfLookupAttempts) | numeric | 3 | Defaults to 3. The maximum number of times to look for the window.performance timings (if available), this is required as not all browsers populate the window.performance before reporting the end of the XHR request and for fetch requests this is added after its complete.
 | [ajaxPerfLookupDelay](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#ajaxPerfLookupDelay) | numeric | 25 | Defaults to 25ms. The amount of time to wait before re-attempting to find the windows.performance timings for an ajax request, time is in milliseconds and is passed directly to setTimeout().
-| [distributedTracingMode](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#distributedTracingMode) | numeric or `DistributedTracingModes` | `DistributedTracingModes.AI_AND_W3C` | Sets the distributed tracing mode. If AI_AND_W3C mode or W3C mode is set, W3C trace context headers (traceparent/tracestate) will be generated and included in all outgoing requests. AI_AND_W3C is provided for back-compatibility with any legacy Application Insights instrumented services.
+| [distributedTracingMode](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#distributedTracingMode) | numeric or `DistributedTracingModes` | `DistributedTracingModes.AI_AND_W3C` | Selects the trace header format for eligible dependency requests. `AI` adds `Request-Id`, `W3C` adds `traceparent`, and `AI_AND_W3C` adds both for backward compatibility with legacy Application Insights services. The correlation header enablement settings and filters still apply. |
 | [enableUnhandledPromiseRejectionTracking](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfig.html#enableUnhandledPromiseRejectionTracking) | boolean | false | If true, unhandled promise rejections will be autocollected and reported as a javascript error. When disableExceptionTracking is true (dont track exceptions) the config value will be ignored and unhandled promise rejections will not be reported.
 | [disableInstrumentationKeyValidation](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfiguration.html#disableInstrumentationKeyValidation) | boolean | false | If true, instrumentation key validation check is bypassed. Default value is false.
 | [enablePerfMgr](https://microsoft.github.io/ApplicationInsights-JS/webSdk/applicationinsights-web/interfaces/IConfiguration.html#enablePerfMgr) | boolean | false | [Optional] When enabled (true) this will create local perfEvents for code that has been instrumented to emit perfEvents (via the doPerf() helper). This can be used to identify performance issues within the SDK based on your usage or optionally within your own instrumented code. [More details are available by the basic documentation](https://microsoft.github.io/ApplicationInsights-JS/PerformanceMonitoring). Since v2.5.7
diff --git a/shared/AppInsightsCore/src/interfaces/ai/IConfig.ts b/shared/AppInsightsCore/src/interfaces/ai/IConfig.ts
index 2024bea41..3c6bb1cf3 100644
--- a/shared/AppInsightsCore/src/interfaces/ai/IConfig.ts
+++ b/shared/AppInsightsCore/src/interfaces/ai/IConfig.ts
@@ -126,14 +126,17 @@ export interface IConfig {
     disableDataLossAnalysis?: boolean;
 
     /**
-     * If false, the SDK will add two headers ('Request-Id' and 'Request-Context') to all dependency requests to correlate them with corresponding requests on the server side. Default is false.
+     * If true, disable correlation headers on dependency requests. If false, requests must still be allowed by
+     * enableCorsCorrelation, correlationHeaderDomains, correlationHeaderExcludedDomains and correlationHeaderExcludePatterns.
+     * distributedTracingMode controls the trace header format. Request-Context is added only when an appId is available.
      * @defaultValue false
      */
     disableCorrelationHeaders?: boolean;
 
     /**
-     * Sets the distributed tracing mode. If AI_AND_W3C mode or W3C mode is set, W3C trace context headers (traceparent/tracestate) will be generated and included in all outgoing requests.
-     * AI_AND_W3C is provided for back-compatibility with any legacy Application Insights instrumented services
+     * Selects the trace header format for eligible dependency requests. AI adds Request-Id, W3C adds traceparent,
+     * and AI_AND_W3C adds both for backward compatibility with legacy Application Insights services.
+     * The correlation header enablement settings and filters still apply.
      * @defaultValue AI_AND_W3C
      */
     distributedTracingMode?: DistributedTracingModes;
@@ -246,7 +249,9 @@ export interface IConfig {
     appId?: string;
 
     /**
-     * If true, the SDK will add two headers ('Request-Id' and 'Request-Context') to all CORS requests to correlate outgoing AJAX dependencies with corresponding requests on the server side. Default is false
+     * If true, allow correlation headers on requests to other hosts. If false, headers are allowed only when
+     * the request host matches the page host. disableCorrelationHeaders: true and the domain and URL exclusion
+     * settings still take precedence.
      * @defaultValue false
      */
     enableCorsCorrelation?: boolean;