The Access-Control-Allow-Headers
response header is used in response to a {{glossary("preflight request")}} to indicate which HTTP headers will be available via {{HTTPHeader("Access-Control-Expose-Header")}} when making the actual request.
The {{glossary("simple header", "simple headers")}}, {{HTTPHeader("Accept")}}, {{HTTPHeader("Accept-Language")}}, {{HTTPHeader("Content-Language")}}, {{HTTPHeader("Content-Type")}} (but only with a MIME type of its parsed value (ignoring parameters) of either application/x-www-form-urlencoded
, multipart/form-data
, or text/plain
), are always available and don't need to be listed by this header.
This header is required if the request has an {{HTTPHeader("Access-Control-Request-Headers")}} header.
Header type | {{Glossary("Response header")}} |
---|---|
{{Glossary("Forbidden header name")}} | no |
Syntax
Access-Control-Allow-Headers: <header-name>, <header-name>, ...
Directives
- <header-name>
- Comma-delimited list of the supported request headers.
Examples
Access-Control-Allow-Headers: X-Custom-Header
Specifications
Specification | Status | Comment |
---|---|---|
{{SpecName('Fetch','#http-access-control-allow-headers', 'Access-Control-Allow-Headers')}} | {{Spec2("Fetch")}} | Initial definition. |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
{{Compat}}
Compatibility notes
- The wildcard value (*) that is mentioned in the latest specification, is not yet implemented in browsers:
- Chromium: Issue 615313
- Firefox: {{bug(1309358)}}
- Servo: Issue 13283
See also
- {{HTTPHeader("Access-Control-Allow-Origin")}}
- {{HTTPHeader("Access-Control-Expose-Headers")}}
- {{HTTPHeader("Access-Control-Allow-Methods")}}
- {{HTTPHeader("Access-Control-Request-Headers")}}