CORS Access-Control Fields

The Access-Control fields describe which cross-origin browser requests and response fields are permitted.

Use Allow-Origin, Allow-Methods, Allow-Headers, Allow-Credentials, Expose-Headers, and Max-Age as one coherent policy rather than adding headers until an error disappears.

httpheadercorssecurity

Reference (http)

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST
Access-Control-Allow-Headers: Content-Type

Use Allow-Origin, Allow-Methods, Allow-Headers, Allow-Credentials, Expose-Headers, and Max-Age as one coherent policy rather than adding headers until an error disappears.

Common mistakes

Using wildcard origins with credentials or forgetting Vary: Origin for dynamic origin responses.

Sources

MDN HTTP Reference
OWASP HTTP Headers Cheat Sheet
MDN CORS Guide
IANA HTTP Field Name Registry