CORSBaseline · Widely available
Cross-Origin Resource Sharing is an HTTP-header based mechanism that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit loading resources. Also known as CORS.
Supported in all major browsers for at least 30 months — safe to use without fallbacks. Baseline since Jul 29, 2015. Widely available since Jan 29, 2018.
Browser support
DesktopChrome
1–3Not supported
4+Supportedsince Jan 25, 2010
Current: 155Edge
12+Supportedsince Jul 29, 2015
Current: 154Firefox
1–3Not supported
3.5+Supportedsince Jun 30, 2009
Current: 157Safari
1–3.1Not supported
4+Supportedsince Jun 8, 2009
Current: 27MobileChrome Android
18+Supportedsince Jun 27, 2012
Current: 155Firefox Android
4+Supportedsince Mar 29, 2011
Current: 157Safari iOS
1–3Not supported
3.2+Supportedsince Apr 3, 2010
Current: 27How to use
This feature is Baseline widely available — use it freely, no fallback needed.
Example
Full syntax and examples are on MDN: Access-Control-Allow-Credentials.
Feature detection
There’s no simple runtime check for this feature; rely on the support table and test in your target browsers.
Documentation (MDN)
Specification
Usage share
Sub-features
Support for each part of the feature (12). The overall table above shows when the whole feature works.
| Sub-feature | Chrome | Edge | Firefox | Safari | Chrome Android | Firefox Android | Safari iOS |
|---|---|---|---|---|---|---|---|
| http.headers.Access-Control-Allow-Credentials | 4 | 12 | 3.5 | 4 | 18 | 4 | 3.2 |
| http.headers.Access-Control-Allow-Headers | 4 | 12 | 3.5 | 4 | 18 | 4 | 3.2 |
| http.headers.Access-Control-Allow-Headers.authorization_not_covered_by_wildcard | ✕ | ✕ | ✕ | ✕ | ✕ | ✕ | ✕ |
| http.headers.Access-Control-Allow-Headers.wildcard | 63 | 79 | 69 | 13 | 63 | 79 | 13 |
| http.headers.Access-Control-Allow-Methods | 4 | 12 | 3.5 | 4 | 18 | 4 | 3.2 |
| http.headers.Access-Control-Allow-Methods.wildcard | 63 | 79 | 69 | 13 | 63 | 79 | 13 |
| http.headers.Access-Control-Allow-Origin | 4 | 12 | 3.5 | 4 | 18 | 4 | 3.2 |
| http.headers.Access-Control-Expose-Headers | 4 | 12 | 3.5 | 4 | 18 | 4 | 3.2 |
| http.headers.Access-Control-Expose-Headers.wildcard | 65 | 79 | 69 | 13 | 65 | 79 | 13 |
| http.headers.Access-Control-Max-Age | 4 | 12 | 3.5 | 4 | 18 | 4 | 3.2 |
| http.headers.Access-Control-Request-Headers | 4 | 12 | 3.5 | 4 | 18 | 4 | 3.2 |
| http.headers.Access-Control-Request-Method | 4 | 12 | 3.5 | 4 | 18 | 4 | 3.2 |