Access-Control-Allow-Methods

Access-Control-Allow-Methods

The Access-Control-Allow-Methods response header specifies one or more methods allowed when accessing a resource in response to a preflight request.

Syntax

Access-Control-Allow-Methods: <method>, <method>, ...
Access-Control-Allow-Methods: *

Directives

<method>

A comma-delimited list of the allowed HTTP request methods.

* (wildcard)

The value "*" only counts as a special wildcard value for requests without credentials (requests without HTTP cookies or HTTP authentication information). In requests with credentials, it is treated as the literal method name "*" without special semantics.

Examples

Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Methods: *

Specifications

Browser compatibility

Desktop Mobile
Chrome Edge Firefox Internet Explorer Opera Safari WebView Android Chrome Android Firefox for Android Opera Android Safari on IOS Samsung Internet
Access-Control-Allow-Methods
4
12
3.5
10
12
4
2
Yes
4
12
3.2
Yes
wildcard
63
79
69
No
50
No
63
63
No
46
No
8.2

See also

© 2005–2021 MDN contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods