# Access-Control-Max-Age Header — Syntax, Values & Examples

> How long, in seconds, a browser may cache the result of a CORS preflight.

Every preflighted request costs an extra OPTIONS round trip. Access-Control-Max-Age on the preflight response lets the browser reuse the answer for the same URL, method and headers. Without it, browsers cache a preflight for only 5 seconds. They also cap it: Chrome at 2 hours (7200 seconds), Firefox at 24 hours (86400).

- Type: Response header
- Category: CORS
- Defined in: [Fetch Standard — CORS protocol](https://fetch.spec.whatwg.org/#http-cors-protocol)

## Syntax

```http
Access-Control-Max-Age: <seconds>
```

## Examples

```http
Access-Control-Max-Age: 600
```

ten minutes

```http
Access-Control-Max-Age: 7200
```

two hours, Chrome's maximum

## Good to know

- Only the preflight (OPTIONS) response needs it.
- A cached preflight keeps old CORS rules alive — keep the value short while changing your config, and test in a private window.
- `-1` disables preflight caching.

## How to set Access-Control-Max-Age

### Express

```
res.set("Access-Control-Max-Age", "600");
```

### Next.js (next.config.js)

```
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Access-Control-Max-Age", value: "600" }],
      },
    ];
  },
};
```

### nginx

```
add_header Access-Control-Max-Age "600" always;
```

### Apache (.htaccess)

```
Header always set Access-Control-Max-Age "600"
```

## Check it

Fetch only the response headers and filter for Access-Control-Max-Age. In the browser, it's under Response Headers in DevTools → Network.

```sh
curl -sI https://example.com/ | grep -i '^access-control-max-age:'
```

## FAQ

### Why does the browser send an OPTIONS request before every API call?

Without Access-Control-Max-Age, preflights are cached for only 5 seconds. Set it to a few minutes or more so repeated calls skip the preflight.

## Status codes it appears with

- [204 No Content](https://www.devkult.com/http/204.md)

## Related headers

- [Access-Control-Allow-Methods](https://www.devkult.com/headers/access-control-allow-methods.md): Lists the HTTP methods a cross-origin request may use, in the response to a CORS preflight.
- [Access-Control-Allow-Headers](https://www.devkult.com/headers/access-control-allow-headers.md): Lists the request headers a cross-origin request may include, in the response to a CORS preflight.
- [Access-Control-Allow-Origin](https://www.devkult.com/headers/access-control-allow-origin.md): Tells the browser which origin may read this response from JavaScript running on another site.

## Further reading

- [CORS errors explained](https://www.devkult.com/blog/cors-errors-explained.md)

Open the interactive page: https://www.devkult.com/headers/access-control-max-age