CORS-safelisted request header
A CORS-safelisted request header is one of the following HTTP headers:
When containing only these headers (and values that meet the additional requirements laid out below), a request doesn't need to send a preflight request in the context of CORS.
You can safelist more headers using the
Access-Control-Allow-Headers header and also list the above headers there to circumvent the following additional restrictions:
CORS-safelisted headers must also fulfill the following requirements in order to be a CORS-safelisted request header:
Content-Language: can only have values consisting of
a-z, space or
Content-Type: can't contain a CORS-unsafe request header byte:
0x09 (HT), which is allowed),
Content-Type: needs to have a MIME type of its parsed value (ignoring parameters) of either
- For any header: the value's length can't be greater than 128.