devkult_
tools29converters34
home/headers/access-control-allow-headers

Access-Control-Allow-Headers

response headercors

Lists the request headers a cross-origin request may include, in the response to a CORS preflight.

If a cross-origin request carries headers beyond a short safelist — Authorization, Content-Type: application/json, any X- header — the browser preflights it and checks this header in the OPTIONS response. Every header the request will send must be listed.

Syntax

Access-Control-Allow-Headers: <header-name>, <header-name>…

Defined in Fetch Standard — CORS protocol.

Examples

Access-Control-Allow-Headers: Content-Type, Authorization

JSON APIs with bearer tokens

Access-Control-Allow-Headers: Content-Type, Authorization, X-Request-Id

plus a custom tracing header

Good to know

  • * covers most headers on requests without credentials, but never Authorization — list that by name.
  • Header names are case-insensitive here.
  • The browser tells you what it wants in the preflight's Access-Control-Request-Headers.

Further reading: CORS errors explained

How to set Access-Control-Allow-Headers

Express
res.set("Access-Control-Allow-Headers", "Content-Type, Authorization");
Next.js (next.config.js)
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Access-Control-Allow-Headers", value: "Content-Type, Authorization" }],
      },
    ];
  },
};
nginx
add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
Apache (.htaccess)
Header always set Access-Control-Allow-Headers "Content-Type, Authorization"

Check it

Fetch only the response headers and filter for Access-Control-Allow-Headers. In the browser, it's under Response Headers in DevTools → Network.

curl -sI https://example.com/ | grep -i '^access-control-allow-headers:'

To compare response headers across many URLs at once, use the HTTP Status Checker.

Frequently asked questions

Why does adding an Authorization header break my CORS request?

Authorization isn't on the safelist, so the browser preflights the request, and the preflight fails unless the OPTIONS response lists Authorization in Access-Control-Allow-Headers.

Related headers