// http header · cors header

Access-Control-Max-Age

How long a preflight result can be cached

What the Access-Control-Max-Age header does

Access-Control-Max-Age says how long (in seconds) the browser may cache a CORS preflight result, so repeated cross-origin requests don't each trigger an extra OPTIONS round trip.

Example

Access-Control-Max-Age: 600

Access-Control-Max-Age in practice

Cache preflight for 10 minutes

Access-Control-Max-Age: 600

Common Access-Control-Max-Age questions and problems

What does Access-Control-Max-Age control?

How many seconds a browser may cache the result of a preflight request, so it does not send an OPTIONS request before every call.

Why is my value ignored?

Browsers cap it. Chromium-based browsers cap the value at 2 hours and Firefox at 24 hours, so larger numbers have no extra effect.

Is this the same as Cache-Control max-age?

No. Cache-Control: max-age controls caching of the response itself. Access-Control-Max-Age only controls the preflight cache.

Access-Control-Max-Age vs related headers

Cache-Control: Cache-Control governs caching of the resource; Access-Control-Max-Age governs only the CORS preflight result.
Age: Age reports how long a cached response has been stored. It is unrelated to preflight caching.

Where it's used

Access-Control-Max-Age is a cors header. CORS headers govern cross-origin requests — which other origins may read a response.

Other cors headers

Access-Control-Allow-Origin Access-Control-Allow-Methods Access-Control-Allow-Headers Access-Control-Allow-Credentials Access-Control-Max-Age