Our volunteers haven't translated this article into 한국어 yet. Join us and help get the job done!
You can also read the article in English (US).
The Access-Control-Allow-Headers response header is used in response to a preflight request to indicate which HTTP headers can be used during the actual request.
The simple headers, Accept, Accept-Language, Content-Language, Content-Type (but only with a MIME type of its parsed value (ignoring parameters) of either application/x-www-form-urlencoded, multipart/form-data, or text/plain), are always available and don't need to be listed by this header.
This header is required if the request has an Access-Control-Request-Headers header.
| Header type | Response header |
|---|---|
| Forbidden header name | no |
Syntax
Access-Control-Allow-Headers: <header-name>, <header-name>, ...
Directives
- <header-name>
- Comma-delimited list of the supported request headers.
Examples
Access-Control-Allow-Headers: X-Custom-Header
Specifications
| Specification | Status | Comment |
|---|---|---|
| Fetch The definition of 'Access-Control-Allow-Headers' in that specification. |
Living Standard | Initial definition. |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
| Feature | Chrome | Edge | Firefox | Internet Explorer | Opera | Safari |
|---|---|---|---|---|---|---|
| Basic support | 4 | 12 | 3.5 | 10 | 12 | 4 |
| Feature | Android webview | Chrome for Android | Edge mobile | Firefox for Android | Opera Android | iOS Safari | Samsung Internet |
|---|---|---|---|---|---|---|---|
| Basic support | 2.1 | Yes | Yes | 4 | 12 | 3.2 | Yes |
Compatibility notes
- The wildcard value (*) that is mentioned in the latest specification, is not yet implemented in browsers:
- Chromium: Issue 615313
- Firefox: bug 1309358
- Servo: Issue 13283
- WebKit: Issue 165508