Access-Control-Max-Age

The Access-Control-Max-Age response header indicates how long the results of a preflight request (that is the information contained in the Access-Control-Allow-Methods and Access-Control-Allow-Headers headers) can be cached.

Header type	Response header
Forbidden header name	no

Syntax

Access-Control-Max-Age: <delta-seconds>

Directives

<delta-seconds>

Maximum number of seconds the results can be cached.
Firefox caps this at 24 hours (86400 seconds) and Chromium at 10 minutes (600 seconds). Chromium also specifies a default value of 5 seconds.

Examples

Cache results of a preflight request for 10 minutes:

Access-Control-Max-Age: 600 

Specifications

Specification	Status	Comment
Fetch The definition of 'Access-Control-Max-Age' in that specification.	Living Standard	Initial definition.

Browser compatibility

See also

• Access-Control-Allow-Headers
• Access-Control-Allow-Methods