# Access-Control-Allow-Headers Header — Values & Examples

> Lists the request headers a cross-origin request may include, in the response to a CORS preflight.

If a cross-origin request carries headers beyond a short safelist — `Authorization`, `Content-Type: application/json`, any `X-` header — the browser preflights it and checks this header in the OPTIONS response. Every header the request will send must be listed.

- Type: Response header
- Category: CORS
- Defined in: [Fetch Standard — CORS protocol](https://fetch.spec.whatwg.org/#http-cors-protocol)

## Syntax

```http
Access-Control-Allow-Headers: <header-name>, <header-name>…
```

## Examples

```http
Access-Control-Allow-Headers: Content-Type, Authorization
```

JSON APIs with bearer tokens

```http
Access-Control-Allow-Headers: Content-Type, Authorization, X-Request-Id
```

plus a custom tracing header

## Good to know

- `*` covers most headers on requests without credentials, but never `Authorization` — list that by name.
- Header names are case-insensitive here.
- The browser tells you what it wants in the preflight's `Access-Control-Request-Headers`.

## How to set Access-Control-Allow-Headers

### Express

```
res.set("Access-Control-Allow-Headers", "Content-Type, Authorization");
```

### Next.js (next.config.js)

```
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Access-Control-Allow-Headers", value: "Content-Type, Authorization" }],
      },
    ];
  },
};
```

### nginx

```
add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
```

### Apache (.htaccess)

```
Header always set Access-Control-Allow-Headers "Content-Type, Authorization"
```

## Check it

Fetch only the response headers and filter for Access-Control-Allow-Headers. In the browser, it's under Response Headers in DevTools → Network.

```sh
curl -sI https://example.com/ | grep -i '^access-control-allow-headers:'
```

## FAQ

### Why does adding an Authorization header break my CORS request?

Authorization isn't on the safelist, so the browser preflights the request, and the preflight fails unless the OPTIONS response lists Authorization in Access-Control-Allow-Headers.

## Related headers

- [Access-Control-Allow-Methods](https://www.devkult.com/headers/access-control-allow-methods.md): Lists the HTTP methods a cross-origin request may use, in the response to a CORS preflight.
- [Access-Control-Allow-Origin](https://www.devkult.com/headers/access-control-allow-origin.md): Tells the browser which origin may read this response from JavaScript running on another site.
- [Authorization](https://www.devkult.com/headers/authorization.md): Carries the client's credentials — a bearer token, Basic username and password, or another scheme.
- [Content-Type](https://www.devkult.com/headers/content-type.md): States the media type of the body — HTML, JSON, form data, an image — and often its character encoding.

## Further reading

- [CORS errors explained](https://www.devkult.com/blog/cors-errors-explained.md)

Open the interactive page: https://www.devkult.com/headers/access-control-allow-headers