// http header · cors header

Access-Control-Allow-Headers

Headers allowed in the actual request

What the Access-Control-Allow-Headers header does

Access-Control-Allow-Headers lists which request headers the actual cross-origin request may include, such as Content-Type or Authorization. The browser checks it during preflight before sending custom headers.

Example

Access-Control-Allow-Headers: Content-Type

Access-Control-Allow-Headers in practice

Allow JSON and auth

Access-Control-Allow-Headers: Content-Type, Authorization

Common Access-Control-Allow-Headers questions and problems

Request header field ... is not allowed by Access-Control-Allow-Headers in preflight response

The request included a non-safelisted header, such as Authorization or a custom X- header, and the preflight response did not list it. Add it to this header on the OPTIONS response.

Does * allow the Authorization header?

No. The wildcard does not cover Authorization, so it must be named explicitly. Wildcards also do not apply to credentialed requests.

Which headers do I not need to list?

CORS-safelisted request headers, such as Accept, Accept-Language and Content-Language, need no listing. Content-Type is safelisted only for a few values, so application/json must be listed.

Access-Control-Allow-Headers vs related headers

Access-Control-Allow-Methods: Allow-Headers lists request headers. Allow-Methods lists HTTP methods.
Access-Control-Request-Headers: The browser sends Access-Control-Request-Headers in the preflight to ask; this header is the server's answer.

Where it's used

Access-Control-Allow-Headers is a cors header. CORS headers govern cross-origin requests — which other origins may read a response.

Other cors headers

Access-Control-Allow-Origin Access-Control-Allow-Methods Access-Control-Allow-Headers Access-Control-Allow-Credentials Access-Control-Max-Age