MDN wants to learn about developers like you: https://qsurvey.mozilla.com/s3/MDN-dev-survey

Access-Control-Allow-Headers

The Access-Control-Allow-Headers response header is used in response to a preflight request to indicate which HTTP headers will be available via Access-Control-Expose-Headers when making the actual request.

The simple headers, Accept, Accept-Language, Content-Language, Content-Type (but only with a MIME type of its parsed value (ignoring parameters) of either application/x-www-form-urlencoded, multipart/form-data, or text/plain), are always available and don't need to be listed by this header.

This header is required if the request has an Access-Control-Request-Headers header.

Header type Response header
Forbidden header name no

Syntax

Access-Control-Allow-Headers: <header-name>, <header-name>, ...

Directives

<header-name>
Comma-delimited list of the supported request headers.

Examples

Access-Control-Allow-Headers: X-Custom-Header

Specifications

Specification Status Comment
Fetch
The definition of 'Access-Control-Allow-Headers' in that specification.
Living Standard Initial definition.

Browser compatibility

FeatureChromeFirefoxEdgeInternet ExplorerOperaSafari
Basic Support43.51210124
FeatureAndroidChrome for AndroidEdge mobileFirefox for AndroidIE mobileOpera AndroidiOS Safari
Basic Support2.1(Yes)(Yes)1.0(Yes)123.2

Compatibility notes

See also

Document Tags and Contributors

 Contributors to this page: fscholz, teoli
 Last updated by: fscholz,