Access-Control-Max-Age

Controls how long a browser may cache a successful CORS preflight result.

Use a bounded max age that matches how quickly the CORS policy changes. Browser-specific maximums can cap the value.

httpheadercorscache

Reference (http)

Access-Control-Max-Age: 600

Use a bounded max age that matches how quickly the CORS policy changes. Browser-specific maximums can cap the value.

Common mistakes

Changing allowed methods or headers while browsers still use a cached preflight.

IANA registry: http-fields/field-names

Registry reference: Fetch

Sources