Headers: Access-Control-Allow-Methods
Access-Control-Allow-Methods header
Baseline Widely available
This feature is well established and works across many devices and browser versions. It’s been available across browsers since July 2015.
The HTTP Access-Control-Allow-Methods response header specifies one or more HTTP request methods allowed when accessing a resource in response to a preflight request.
| Header type | Response header |
|---|
Syntax
Access-Control-Allow-Methods: <method>, <method>, … Access-Control-Allow-Methods: *
Directives
<method>-
A comma-separated list of the allowed request methods.
GET,HEAD, andPOSTare always allowed, regardless of whether they are specified in this header, as they are defined as CORS-safelisted methods. *(wildcard)-
All HTTP methods. It has this meaning only for requests without credentials (requests without HTTP cookies or HTTP authentication information). In requests with credentials, it is treated as the literal method name
*without special semantics.
Examples
Access-Control-Allow-Methods: PUT, DELETE Access-Control-Allow-Methods: *
Specifications
| Specification |
|---|
| Fetch> # http-access-control-allow-methods> |
Browser compatibility
| Desktop | Mobile | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Chrome | Edge | Firefox | Opera | Safari | Chrome Android | Firefox for Android | Opera Android | Safari on IOS | Samsung Internet | WebView Android | WebView on iOS | |
Access-Control-Allow-Methods |
4 | 12 | 3.5 | 12 | 4 | 18 | 4 | 12 | 3.2 | 1.0 | 2 | 3.2 |
wildcard |
63 | 79 | 69 | 50 | 13 | 63 | 79 | 46 | 13 | 8.2 | 63 | 13 |
See also
© 2005–2025 MDN contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Methods
