Access-Control-Allow-Headers

The Access-Control-Allow-Headers response header is used in response to a preflight request to indicate which HTTP headers will be available via Access-Control-Expose-Headers when making the actual request.

The simple headers, Accept, Accept-Language, Content-Language, Content-Type (but only with a MIME type of its parsed value (ignoring parameters) of either application/x-www-form-urlencoded, multipart/form-data, or text/plain), are always available and don't need to be listed by this header.

This header is required if the request has an Access-Control-Request-Headers header.

Header type	Response header
Forbidden header name	no

Syntax

Access-Control-Allow-Headers: <header-name>, <header-name>, ...

Directives

<header-name>

Comma-delimited list of the supported request headers.

Examples

Access-Control-Allow-Headers: X-Custom-Header

Specifications

Specification	Status	Comment
Fetch The definition of 'Access-Control-Allow-Headers' in that specification.	Living Standard	Initial definition.

Browser compatibility

Compatibility notes

• The wildcard value (*) that is mentioned in the latest specification, is not yet implemented in browsers:
  • Chromium: Issue 615313
  • Firefox: bug 1309358
  • Servo: Issue 13283

See also

• Access-Control-Allow-Origin
• Access-Control-Expose-Headers
• Access-Control-Allow-Methods
• Access-Control-Request-Headers