响应首部 Access-Control-Allow-Headers 用于 preflight request （预检请求）中，列出了将会在正式请求的 Access-Control-Expose-Headers 字段中出现的首部信息。
简单首部，如 simple headers、Accept、Accept-Language、Content-Language、Content-Type （只限于解析后的值为 application/x-www-form-urlencoded、multipart/form-data 或 text/plain 三种MIME类型（不包括参数）），它们始终是被支持的，不需要在这个首部特意列出。
如果请求中含有 Access-Control-Request-Headers 字段，那么这个首部是必要的。
| Header type | Response header |
|---|---|
| Forbidden header name | no |
语法
Access-Control-Allow-Headers: <header-name>, <header-name>, ...
指令
- <header-name>
- 可以支持的消息首部列表，用逗号隔开。
示例
Access-Control-Allow-Headers: X-Custom-Header
规范
| Specification | Status | Comment |
|---|---|---|
| Fetch Access-Control-Allow-Headers |
Living Standard | Initial definition. |
浏览器兼容性
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Update compatibility data on GitHub
| Desktop | Mobile | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Basic support | Chrome Full support 4 | Edge Full support 12 | Firefox Full support 3.5 | IE Full support 10 | Opera Full support 12 | Safari Full support 4 | WebView Android Full support 2 | Chrome Android Full support Yes | Edge Mobile Full support Yes | Firefox Android Full support 4 | Opera Android Full support 12 | Safari iOS Full support 3.2 | Samsung Internet Android Full support Yes |
Legend
- Full support
- Full support
有关兼容性的注意事项
- 在最新规范中提出的通配符(*)，尚未被如下浏览器实现：
- Chromium: Issue 615313
- Firefox: bug 1309358
- Servo: Issue 13283