How Access-Control-Allow-Headers works
Any request header outside a short safe list (Accept, Accept-Language, Content-Language, and Content-Type with form or text values) triggers a preflight, and must be listed here. The usual ones are Content-Type (for JSON) and Authorization.
Examples
Access-Control-Allow-Headers: Content-Type, AuthorizationCommon mistakes
-
*does not cover Authorization: it must always be listed by name.
Check it
curl -sI https://example.com | grep -i '^access-control-allow-headers:'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- Access-Control-Allow-Methods: lists the HTTP methods allowed for a cross-origin request, in answer to a preflight.
- Access-Control-Expose-Headers: lets JavaScript read extra response headers from a cross-origin response.
- Authorization: carries the client’s credentials: a bearer token, Basic username and password, or another scheme.
More cors headers
Access-Control-Allow-Origin , Access-Control-Allow-Credentials , Access-Control-Max-Age , Origin .
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the Access-Control-Allow-Headers header do?
The Access-Control-Allow-Headers response header lists the request headers a cross-origin request may send, in answer to a preflight. Any request header outside a short safe list (Accept, Accept-Language, Content-Language, and Content-Type with form or text values) triggers a preflight, and must be listed here. The usual ones are Content-Type (for JSON) and Authorization.
How do I see the Access-Control-Allow-Headers header?
Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.