home/headers/access-control-max-age

Access-Control-Max-Age

response headercors

How long, in seconds, a browser may cache the result of a CORS preflight.

Every preflighted request costs an extra OPTIONS round trip. Access-Control-Max-Age on the preflight response lets the browser reuse the answer for the same URL, method and headers. Without it, browsers cache a preflight for only 5 seconds. They also cap it: Chrome at 2 hours (7200 seconds), Firefox at 24 hours (86400).

Syntax

Access-Control-Max-Age: <seconds>

Defined in Fetch Standard — CORS protocol.

Examples

Access-Control-Max-Age: 600

ten minutes

Access-Control-Max-Age: 7200

two hours, Chrome's maximum

Good to know

Only the preflight (OPTIONS) response needs it.
A cached preflight keeps old CORS rules alive — keep the value short while changing your config, and test in a private window.
-1 disables preflight caching.

How to set Access-Control-Max-Age

Express

res.set("Access-Control-Max-Age", "600");

Next.js (next.config.js)

module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Access-Control-Max-Age", value: "600" }],
      },
    ];
  },
};

nginx

add_header Access-Control-Max-Age "600" always;

Apache (.htaccess)

Header always set Access-Control-Max-Age "600"

Check it

Fetch only the response headers and filter for Access-Control-Max-Age. In the browser, it's under Response Headers in DevTools → Network.

curl -sI https://example.com/ | grep -i '^access-control-max-age:'

To compare response headers across many URLs at once, use the HTTP Status Checker.

Frequently asked questions

Why does the browser send an OPTIONS request before every API call?

Without Access-Control-Max-Age, preflights are cached for only 5 seconds. Set it to a few minutes or more so repeated calls skip the preflight.

Status codes it appears with

204 No Content