我们的志愿者还没有将这篇文章翻译为 中文 (简体)。加入我们帮助完成翻译!
The Access-Control-Allow-Credentials
response header indicates whether or not the response to the request can be exposed to the page. It can be exposed when the true
value is returned; it can't in other cases.
Credentials are cookies, authorization headers or TLS client certificates.
When used as part of a response to a preflight request, this indicates whether or not the actual request can be made using credentials. Note that simple GET
requests are not preflighted, and so if a request is made for a resource with credentials, if this header is not returned with the resource, the response is ignored by the browser and not returned to web content.
The Access-Control-Allow-Credentials
header works in conjunction with the XMLHttpRequest.withCredentials
property or with the credentials
option in the Request()
constructor of the Fetch API. Credentials must be set on both sides (the Access-Control-Allow-Credentials
header and in the XHR or Fetch request) in order for the CORS request with credentials to succeed.
Header type | Response header |
---|---|
Forbidden header name | no |
Syntax
Access-Control-Allow-Credentials: true
Directives
- true
- The only valid value for this header is
true
(case-sensitive). If you don't need credentials, omit this header entirely (rather than setting its value tofalse
).
Examples
Allow credentials:
Access-Control-Allow-Credentials: true
Using XHR with credentials:
var xhr = new XMLHttpRequest(); xhr.open('GET', 'https://example.com/', true); xhr.withCredentials = true; xhr.send(null);
Using Fetch with credentials:
fetch(url, { credentials: 'include' })
Specifications
Specification | Status | Comment |
---|---|---|
Fetch The definition of 'Access-Control-Allow-Credentials' in that specification. |
Living Standard | Initial definition |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Feature | Chrome | Edge | Firefox | Internet Explorer | Opera | Safari | Servo |
---|---|---|---|---|---|---|---|
Basic Support | 4 | 12 | 3.5 | 10 | 12 | 4 | ? |
Feature | Android | Chrome for Android | Edge Mobile | Firefox for Android | IE Mobile | Opera Mobile | Safari Mobile |
---|---|---|---|---|---|---|---|
Basic Support | 2.1 | (Yes) | (Yes) | 1.0 | (Yes) | 12 | 3.2 |