Access-Control-Allow-Methods

响应首部 Access-Control-Allow-Methods 在对 preflight request.（预检请求）的应答中明确了客户端所要访问的资源允许使用的方法或方法列表。

报头类型 Response header
Forbidden header name no

语法

Access-Control-Allow-Methods: <method>, <method>, ...

指令

<method>
用逗号隔开的允许使用的 HTTP request methods 列表。

例子

Access-Control-Allow-Methods: POST, GET, OPTIONS

规范

规范 状态 注释
Fetch
Access-Control-Allow-Methods		 Living Standard Initial definition

浏览器兼容性

Update compatibility data on GitHub
DesktopMobile
ChromeEdgeFirefoxInternet ExplorerOperaSafariAndroid webviewChrome for AndroidFirefox for AndroidOpera for AndroidSafari on iOSSamsung Internet
Access-Control-Allow-MethodsChrome Full support 4Edge Full support 12Firefox Full support 3.5IE Full support 10Opera Full support 12Safari Full support 4WebView Android Full support 2Chrome Android Full support YesFirefox Android Full support 4Opera Android Full support 12Safari iOS Full support 3.2Samsung Internet Android Full support Yes
Wildcard (*)Chrome Full support 63Edge No support NoFirefox Full support 69IE No support NoOpera Full support 50Safari No support NoWebView Android Full support 63Chrome Android Full support 63Firefox Android No support NoOpera Android Full support 46Safari iOS No support NoSamsung Internet Android Full support 8.2

Legend

Full support  
Full support
No support  
No support

兼容性注解

查看更多

相关主题
  1. HTTP
  2. Guides:
  3. Resources and URIs
    1. Identifying resources on the Web
    2. Data URIs
    3. Introduction to MIME Types
    4. Complete list of MIME Types
    5. Choosing between www and non-www URLs
  4. HTTP guide
    1. Basics of HTTP
    2. Overview of HTTP
    3. Evolution of HTTP
    4. HTTP Messages
    5. A typical HTTP session
    6. Connection management in HTTP/1.x
    7. Protocol upgrade mechanism
  5. HTTP security
    1. Content Security Policy (CSP)
    2. HTTP Public Key Pinning (HPKP)
    3. HTTP Strict Transport Security (HSTS)
    4. Cookie security
    5. X-Content-Type-Options
    6. X-Frame-Options
    7. X-XSS-Protection
    8. Mozilla web security guidelines
    9. Mozilla Observatory
  6. HTTP access control (CORS)
  7. HTTP authentication
  8. HTTP caching
  9. HTTP compression
  10. HTTP conditional requests
  11. HTTP content negotiation
  12. HTTP cookies
  13. HTTP range requests
  14. HTTP redirects
  15. HTTP specifications
  16. Feature policy
  17. References:
  18. HTTP headers
    1. Accept
    2. Accept-CH
    3. Accept-CH-Lifetime
    4. Accept-Charset
    5. Accept-Encoding
    6. Accept-Language
    7. Accept-Patch
    8. Accept-Ranges
    9. Access-Control-Allow-Credentials
    10. Access-Control-Allow-Headers
    11. Access-Control-Allow-Methods
    12. Access-Control-Allow-Origin
    13. Access-Control-Expose-Headers
    14. Access-Control-Max-Age
    15. Access-Control-Request-Headers
    16. Access-Control-Request-Method
    17. Age
    18. Allow
    19. Alt-Svc
    20. Authorization
    21. Cache-Control
    22. Clear-Site-Data
    23. Connection
    24. Content-Disposition
    25. Content-Encoding
    26. Content-Language
    27. Content-Length
    28. Content-Location
    29. Content-Range
    30. Content-Security-Policy
    31. Content-Security-Policy-Report-Only
    32. Content-Type
    33. Cookie
    34. Cookie2
    35. Cross-Origin-Resource-Policy
    36. DNT
    37. DPR
    38. Date
    39. Device-Memory [我来译!]
    40. Digest
    41. ETag
    42. Early-Data
    43. Expect
    44. Expect-CT
    45. Expires
    46. Feature-Policy
    47. Forwarded
    48. From
    49. Host
    50. If-Match
    51. If-Modified-Since
    52. If-None-Match
    53. If-Range
    54. If-Unmodified-Since
    55. Index
    56. Keep-Alive
    57. Large-Allocation
    58. Last-Modified
    59. Link
    60. Location
    61. Origin
    62. Pragma
    63. Proxy-Authenticate
    64. Proxy-Authorization
    65. Public-Key-Pins
    66. Public-Key-Pins-Report-Only
    67. Range
    68. Referer
    69. Referrer-Policy
    70. Retry-After
    71. Save-Data
    72. Sec-WebSocket-Accept
    73. Server
    74. Server-Timing
    75. Set-Cookie
    76. Set-Cookie2
    77. SourceMap
    78. HTTP Strict Transport Security
    79. TE
    80. Timing-Allow-Origin
    81. Tk
    82. Trailer
    83. Transfer-Encoding
    84. Upgrade-Insecure-Requests
    85. User-Agent
    86. Vary
    87. Via
    88. WWW-Authenticate
    89. Want-Digest [我来译!]
    90. Warning
    91. X-Content-Type-Options
    92. X-DNS-Prefetch-Control
    93. X-Forwarded-For
    94. X-Forwarded-Host
    95. X-Forwarded-Proto
    96. X-Frame-Options
    97. X-XSS-Protection
  19. HTTP request methods
    1. CONNECT
    2. DELETE
    3. GET
    4. HEAD
    5. OPTIONS
    6. PATCH
    7. POST
    8. PUT
    9. TRACE
  20. HTTP response status codes
    1. 100 Continue
    2. 101 Switching Protocol
    3. 103 Early Hints
    4. 200 OK
    5. 201 Created
    6. 202 Accepted
    7. 203 Non-Authoritative Information
    8. 204 No Content
    9. 205 Reset Content
    10. 206 Partial Content
    11. 300 Multiple Choices
    12. 301 Moved Permanently
    13. 302 Found
    14. 303 See Other
    15. 304 Not Modified
    16. 307 Temporary Redirect
    17. 308 Permanent Redirect
    18. 400 Bad Request
    19. 401 Unauthorized
    20. 402 Payment Required
    21. 403 Forbidden
    22. 404 Not Found
    23. 405 Method Not Allowed
    24. 406 Not Acceptable
    25. 407 Proxy Authentication Required
    26. 408 Request Timeout
    27. 409 Conflict
    28. 410 Gone
    29. 411 Length Required
    30. 412 Precondition Failed
    31. 413 Payload Too Large
    32. 414 URI Too Long
    33. 415 Unsupported Media Type
    34. 416 Range Not Satisfiable
    35. 417 Expectation Failed
    36. 418 I'm a teapot
    37. 422 Unprocessable Entity
    38. 425 Too Early
    39. 426 Upgrade Required
    40. 428 Precondition Required
    41. 429 Too Many Requests
    42. 431 Request Header Fields Too Large
    43. 451 Unavailable For Legal Reasons
    44. 500 Internal Server Error
    45. 501 Not Implemented
    46. 502 Bad Gateway
    47. 503 Service Unavailable
    48. 504 Gateway Timeout
    49. 505 HTTP Version Not Supported
    50. 506 Variant Also Negotiates [我来译!]
    51. 507 Insufficient Storage [我来译!]
    52. 508 Loop Detected [我来译!]
    53. 510 Not Extended [我来译!]
    54. 511 Network Authentication Required
  21. CSP directives
    1. CSP: base-uri
    2. CSP: block-all-mixed-content
    3. CSP: child-src
    4. CSP: connect-src
    5. CSP: default-src
    6. CSP: font-src
    7. CSP: form-action
    8. CSP: frame-ancestors
    9. CSP: frame-src [我来译!]
    10. CSP: img-src [我来译!]
    11. CSP: manifest-src [我来译!]
    12. CSP: media-src [我来译!]
    13. CSP: navigate-to [我来译!]
    14. CSP: object-src [我来译!]
    15. CSP: plugin-types [我来译!]
    16. CSP: prefetch-src [我来译!]
    17. CSP: referrer [我来译!]
    18. report-to
    19. CSP: report-uri [我来译!]
    20. CSP: require-sri-for
    21. CSP: sandbox
    22. CSP: script-src [我来译!]
    23. CSP: script-src-attr [我来译!]
    24. CSP: script-src-elem [我来译!]
    25. CSP: style-src [我来译!]
    26. CSP: style-src-attr [我来译!]
    27. CSP: style-src-elem [我来译!]
    28. CSP: trusted-types [我来译!]
    29. CSP: upgrade-insecure-requests
    30. CSP: worker-src [我来译!]
  22. CORS errors
    1. Reason: CORS disabled
    2. 原因：CORS 头 'Access-Control-Allow-Origin'与'xyz'不匹配
    3. Reason: CORS header 'Access-Control-Allow-Origin' missing
    4. Reason: CORS header ‘Origin’ cannot be added
    5. Reason: CORS preflight channel did not succeed
    6. Reason: CORS request did not succeed
    7. Reason: CORS request external redirect not allowed
    8. 原因：CORS 请求不是 HTTP
    9. Reason: Credential is not supported if the CORS header ‘Access-Control-Allow-Origin’ is ‘*’
    10. Reason: Did not find method in CORS header ‘Access-Control-Allow-Methods’
    11. Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed
    12. Reason: expected ‘true’ in CORS header ‘Access-Control-Allow-Credentials’ [我来译!]
    13. Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’ [我来译!]
    14. Reason: invalid token ‘xyz’ in CORS header ‘Access-Control-Allow-Methods’ [我来译!]
    15. Reason: missing token ‘xyz’ in CORS header ‘Access-Control-Allow-Headers’ from CORS preflight channel [我来译!]
  23. Feature-Policy directives
    1. Feature-Policy: accelerometer [我来译!]
    2. Feature-Policy: ambient-light-sensor [我来译!]
    3. Feature-Policy: autoplay
    4. Feature-Policy: battery [我来译!]
    5. Feature-Policy: camera [我来译!]
    6. Feature-Policy: display-capture [我来译!]
    7. Feature-Policy: document-domain [我来译!]
    8. Feature-Policy: encrypted-media [我来译!]
    9. Feature-Policy: fullscreen [我来译!]
    10. Feature-Policy: geolocation [我来译!]
    11. Feature-Policy: gyroscope [我来译!]
    12. Feature-Policy: layout-animations [我来译!]
    13. Feature-Policy: legacy-image-formats [我来译!]
    14. Feature-Policy: magnetometer [我来译!]
    15. Feature-Policy: microphone [我来译!]
    16. Feature-Policy: midi [我来译!]
    17. Feature-Policy: oversized-images [我来译!]
    18. Feature-Policy: payment [我来译!]
    19. Feature-Policy: picture-in-picture [我来译!]
    20. Feature-Policy: publickey-credentials [我来译!]
    21. Feature-Policy: speaker [我来译!]
    22. Feature-Policy: sync-xhr [我来译!]
    23. Feature-Policy: unoptimized-images [我来译!]
    24. Feature-Policy: unsized-media [我来译!]
    25. Feature-Policy: usb [我来译!]
    26. Feature-Policy: vibrate [我来译!]
    27. Feature-Policy: vr [我来译!]
    28. Feature-Policy: wake-lock [我来译!]
    29. Feature-Policy: xr [我来译!]
    30. Feature-Policy: xr-spatial-tracking [我来译!]