W3cubDocs

Cross-Origin Resource Sharing

Method of performing XMLHttpRequests across domains

Spec	https://fetch.spec.whatwg.org/#http-cors-protocol
Status	WHATWG Living Standard

IE	Edge	Firefox	Chrome	Safari	Opera
		147	144
		146	143	TP ⁽³⁾
		145	142	26.1 ⁽³⁾
11	141	144	141	26.0 ⁽³⁾	122
10 ⁽¹⁾	140	143	140	18.5-18.6 ⁽³⁾	121
9 ⁽²⁾	139	142	139	18.4 ⁽³⁾	120
8 ⁽²⁾	138	141	138	18.3 ⁽³⁾	119
Show all
7	137	140	137	18.2 ⁽³⁾	118
6	136	139	136	18.1 ⁽³⁾	117
5.5	135	138	135	18.0 ⁽³⁾	116
	134	137	134	17.6 ⁽³⁾	115
	133	136	133	17.5 ⁽³⁾	114
	132	135	132	17.4 ⁽³⁾	113
	131	134	131	17.3 ⁽³⁾	112
	130	133	130	17.2 ⁽³⁾	111
	129	132	129	17.1 ⁽³⁾	110
	128	131	128	17.0 ⁽³⁾	109
	127	130	127	16.6 ⁽³⁾	108
	126	129	126	16.5 ⁽³⁾	107
	125	128	125	16.4 ⁽³⁾	106
	124	127	124	16.3 ⁽³⁾	105
	123	126	123	16.2 ⁽³⁾	104
	122	125	122	16.1 ⁽³⁾	103
	121	124	121	16.0 ⁽³⁾	102
	120	123	120	15.6 ⁽³⁾	101
	119	122	119	15.5 ⁽³⁾	100
	118	121	118	15.4 ⁽³⁾	99
	117	120	117	15.2-15.3 ⁽³⁾	98
	116	119	116	15.1 ⁽³⁾	97
	115	118	115	15 ⁽³⁾	96
	114	117	114	14.1 ⁽³⁾	95
	113	116	113	14 ⁽³⁾	94
	112	115	112	13.1 ⁽³⁾	93
	111	114	111	13 ⁽³⁾	92
	110	113	110	12.1 ⁽³⁾	91
	109	112	109	12 ⁽³⁾	90
	108	111	108	11.1 ⁽³⁾	89
	107	110	107	11 ⁽³⁾	88
	106	109	106	10.1 ⁽³⁾	87
	105	108	105	10 ⁽³⁾	86
	104	107	104	9.1 ⁽³⁾	85
	103	106	103	9 ⁽³⁾	84
	102	105	102	8 ⁽³⁾	83
	101	104	101	7.1 ⁽³⁾	82
	100	103	100	7 ⁽³⁾	81
	99	102	99	6.1 ⁽³⁾	80
	98	101	98	6 ⁽³⁾	79
	97	100	97	5.1 ^(1,3)	78
	96	99	96	5 ^(1,3)	77
	95	98	95	4 ^(1,3)	76
	94	97	94	3.2	75
	93	96	93	3.1	74
	92	95	92		73
	91	94	91		72
	90	93	90		71
	89	92	89		70
	88	91	88		69
	87	90	87		68
	86	89	86		67
	85	88	85		66
	84	87	84		65
	83	86	83		64
	81	85	81		63
	80	84	80		62
	79	83	79		60
	18	82	78		58
	17	81	77		57
	16	80	76		56
	15	79	75		55
	14	78	74		54
	13	77	73		53
	12	76	72		52
		75	71		51
		74	70		50
		73	69		49
		72	68		48
		71	67		47
		70 ⁽⁴⁾	66		46
		69 ⁽⁴⁾	65		45
		68 ⁽⁴⁾	64		44
		67 ⁽⁴⁾	63		43
		66 ⁽⁴⁾	62		42
		65 ⁽⁴⁾	61		41
		64 ⁽⁴⁾	60		40
		63 ⁽⁴⁾	59		39
		62 ⁽⁴⁾	58		38
		61 ⁽⁴⁾	57		37
		60	56		36
		59	55		35
		58	54		34
		57	53		33
		56	52		32
		55	51		31
		54	50		30
		53	49		29
		52	48		28
		51	47		27
		50	46		26
		49	45		25
		48	44		24
		47	43		23
		46	42		22
		45	41		21
		44	40		20
		43	39		19
		42	38		18
		41	37		17
		40	36		16
		39	35		15
		38	34		12.1
		37	33		12
		36	32		11.6
		35	31		11.5
		34	30		11.1
		33	29		11
		32	28		10.6
		31	27		10.5
		30	26		10.0-10.1
		29	25		9.5-9.6
		28	24		9
		27	23
		26	22
		25	21
		24	20
		23	19
		22	18
		21	17
		20	16
		19	15
		18	14
		17	13
		16	12 ⁽¹⁾
		15	11 ⁽¹⁾
		14	10 ⁽¹⁾
		13	9 ⁽¹⁾
		12	8 ⁽¹⁾
		11	7 ⁽¹⁾
		10	6 ⁽¹⁾
		9	5 ⁽¹⁾
		8	4 ⁽¹⁾
		7
		6
		5
		4
		3.6
		3.5
		3
		2

Safari on iOS	Opera Mini	Android Browser	Blackberry Browser	Opera Mobile	Android Chrome	Android Firefox	IE Mobile	Android UC Browser	Samsung Internet	QQ Browser	Baidu Browser	KaiOS Browser
26.1 ⁽³⁾
26.0 ⁽³⁾	all	141	10	80	141	143	11	15.5	28	14.9	13.52	3.0-3.1
18.5-18.6 ⁽³⁾		4.4.3-4.4.4	7 ⁽¹⁾	12.1			10 ⁽¹⁾		27			2.5
18.4 ⁽³⁾		4.4		12					26
18.3 ⁽³⁾		4.2-4.3 ⁽¹⁾		11.5					25
Show all
18.2 ⁽³⁾		4.1 ⁽¹⁾		11.1					24
18.1 ⁽³⁾		4 ⁽¹⁾		11					23
18.0 ⁽³⁾		3 ⁽¹⁾		10					22
17.6-17.7 ⁽³⁾		2.3 ⁽¹⁾							21
17.5 ⁽³⁾		2.2 ⁽¹⁾							20
17.4 ⁽³⁾		2.1 ⁽¹⁾							19.0
17.3 ⁽³⁾									18.0
17.2 ⁽³⁾									17.0
17.1 ⁽³⁾									16.0
17.0 ⁽³⁾									15.0
16.6-16.7 ⁽³⁾									14.0
16.5 ⁽³⁾									13.0
16.4 ⁽³⁾									12.0
16.3 ⁽³⁾									11.1-11.2
16.2 ⁽³⁾									10.1
16.1 ⁽³⁾									9.2
16.0 ⁽³⁾									8.2
15.6-15.8 ⁽³⁾									7.2-7.4
15.5 ⁽³⁾									6.2-6.4
15.4 ⁽³⁾									5.0-5.4
15.2-15.3 ⁽³⁾									4
15.0-15.1 ⁽³⁾
14.5-14.8 ⁽³⁾
14.0-14.4 ⁽³⁾
13.4-13.7 ⁽³⁾
13.3 ⁽³⁾
13.2 ⁽³⁾
13.0-13.1 ⁽³⁾
12.2-12.5 ⁽³⁾
12.0-12.1 ⁽³⁾
11.3-11.4 ⁽³⁾
11.0-11.2 ⁽³⁾
10.3 ⁽³⁾
10.0-10.2 ⁽³⁾
9.3 ⁽³⁾
9.0-9.2 ⁽³⁾
8.1-8.4 ⁽³⁾
8 ⁽³⁾
7.0-7.1 ⁽³⁾
6.0-6.1 ⁽³⁾
5.0-5.1 ^(1,3)
4.2-4.3 ^(1,3)
4.0-4.1 ^(1,3)
3.2 ^(1,3)

Notes

Does not support CORS for images in <canvas>
Supported somewhat in IE8 and IE9 using the XDomainRequest object (but has limitations)
Does not support CORS for <video> in <canvas>: https://bugs.webkit.org/show_bug.cgi?id=135379
Does not support CORS for resources which redirect: https://bugzilla.mozilla.org/show_bug.cgi?id=1346749

Bugs

IE10+ does not send cookies when withCredential=true (IE Bug #759587). A workaround is to use a P3P policy
IE10+ does not make a CORS request if port is the only difference (IE Bug #781303)
Android and some old versions of WebKit (that may be found in various webview implementations) do not support Access-Control-Expose-Headers: https://code.google.com/p/android/issues/detail?id=56726
IE11 does not appear to support CORS for images in the canvas element

Resources

Data by caniuse.com
Licensed under the Creative Commons Attribution License v4.0.
https://caniuse.com/cors