Access-Control-Allow-Methods

The Access-Control-Allow-Methods response header specifies the method or methods allowed when accessing the resource in response to a preflight request.

Header type	Response header
Forbidden header name	no

Syntax

Access-Control-Allow-Methods: <method>, <method>, ...

Directives

<method>

Comma-delimited list of the allowed HTTP request methods.

Examples

Access-Control-Allow-Methods: POST, GET, OPTIONS

Specifications

Specification	Status	Comment
Fetch The definition of 'Access-Control-Allow-Methods' in that specification.	Living Standard	Initial definition

Browser compatibility

Compatibility notes

• The wildcard value (*) that is mentioned in the latest specification, is not yet implemented in browsers:
  • Chromium: Issue 615313
  • Firefox: bug 1309358
  • Servo: Issue 13283

See also

• Access-Control-Allow-Origin
• Access-Control-Expose-Headers
• Access-Control-Allow-Headers
• Access-Control-Request-Methods