Headers: Access-Control-Request-Headers
Access-Control-Request-Headers header
Baseline Widely available
This feature is well established and works across many devices and browser versions. It’s been available across browsers since July 2015.
The HTTP Access-Control-Request-Headers request header is used by browsers when issuing a preflight request to let the server know which HTTP headers the client might send when the actual request is made (such as with fetch() or XMLHttpRequest.setRequestHeader()). The complementary server-side header of Access-Control-Allow-Headers will answer this browser-side header.
| Header type | Request header |
|---|---|
| Forbidden request header | Yes |
Syntax
Access-Control-Request-Headers: <header-name>,<header-name>,…
Directives
<header-name>-
A sorted list of unique, comma-separated, lowercase HTTP headers that are included in the request.
Examples
Access-Control-Request-Headers: content-type,x-pingother
Specifications
| Specification |
|---|
| Fetch> # http-access-control-request-headers> |
Browser compatibility
| Desktop | Mobile | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Chrome | Edge | Firefox | Opera | Safari | Chrome Android | Firefox for Android | Opera Android | Safari on IOS | Samsung Internet | WebView Android | WebView on iOS | |
Access-Control-Request-Headers |
4 | 12 | 3.5 | 12 | 4 | 18 | 4 | 12 | 3.2 | 1.0 | 2 | 3.2 |
See also
© 2005–2025 MDN contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Request-Headers
