W3cubDocs

Cross-Origin Resource Sharing

Method of performing XMLHttpRequests across domains

Spec	https://fetch.spec.whatwg.org/#http-cors-protocol
Status	WHATWG Living Standard

IE	Edge	Firefox	Chrome	Safari	Opera
			108
		107	107	TP ⁽³⁾
		106	106	16.1 ⁽³⁾
11	105	105	105	16.0 ⁽³⁾	91
10 ⁽¹⁾	104	104	104	15.6 ⁽³⁾	90
9 ⁽²⁾	103	103	103	15.5 ⁽³⁾	89
8 ⁽²⁾	102	102	102	15.4 ⁽³⁾	88
Show all
7	101	101	101	15.2-15.3 ⁽³⁾	87
6	100	100	100	15.1 ⁽³⁾	86
5.5	99	99	99	15 ⁽³⁾	85
	98	98	98	14.1 ⁽³⁾	84
	97	97	97	14 ⁽³⁾	83
	96	96	96	13.1 ⁽³⁾	82
	95	95	95	13 ⁽³⁾	81
	94	94	94	12.1 ⁽³⁾	80
	93	93	93	12 ⁽³⁾	79
	92	92	92	11.1 ⁽³⁾	78
	91	91	91	11 ⁽³⁾	77
	90	90	90	10.1 ⁽³⁾	76
	89	89	89	10 ⁽³⁾	75
	88	88	88	9.1 ⁽³⁾	74
	87	87	87	9 ⁽³⁾	73
	86	86	86	8 ⁽³⁾	72
	85	85	85	7.1 ⁽³⁾	71
	84	84	84	7 ⁽³⁾	70
	83	83	83	6.1 ⁽³⁾	69
	81	82	81	6 ⁽³⁾	68
	80	81	80	5.1 ^(1,3)	67
	79	80	79	5 ^(1,3)	66
	18	79	78	4 ^(1,3)	65
	17	78	77	3.2	64
	16	77	76	3.1	63
	15	76	75		62
	14	75	74		60
	13	74	73		58
	12	73	72		57
		72	71		56
		71	70		55
		70 ⁽⁴⁾	69		54
		69 ⁽⁴⁾	68		53
		68 ⁽⁴⁾	67		52
		67 ⁽⁴⁾	66		51
		66 ⁽⁴⁾	65		50
		65 ⁽⁴⁾	64		49
		64 ⁽⁴⁾	63		48
		63 ⁽⁴⁾	62		47
		62 ⁽⁴⁾	61		46
		61 ⁽⁴⁾	60		45
		60	59		44
		59	58		43
		58	57		42
		57	56		41
		56	55		40
		55	54		39
		54	53		38
		53	52		37
		52	51		36
		51	50		35
		50	49		34
		49	48		33
		48	47		32
		47	46		31
		46	45		30
		45	44		29
		44	43		28
		43	42		27
		42	41		26
		41	40		25
		40	39		24
		39	38		23
		38	37		22
		37	36		21
		36	35		20
		35	34		19
		34	33		18
		33	32		17
		32	31		16
		31	30		15
		30	29		12.1
		29	28		12
		28	27		11.6
		27	26		11.5
		26	25		11.1
		25	24		11
		24	23		10.6
		23	22		10.5
		22	21		10.0-10.1
		21	20		9.5-9.6
		20	19		9
		19	18
		18	17
		17	16
		16	15
		15	14
		14	13
		13	12 ⁽¹⁾
		12	11 ⁽¹⁾
		11	10 ⁽¹⁾
		10	9 ⁽¹⁾
		9	8 ⁽¹⁾
		8	7 ⁽¹⁾
		7	6 ⁽¹⁾
		6	5 ⁽¹⁾
		5	4 ⁽¹⁾
		4
		3.6
		3.5
		3
		2

Does not support CORS for images in <canvas>
Supported somewhat in IE8 and IE9 using the XDomainRequest object (but has limitations)
Does not support CORS for <video> in <canvas>: https://bugs.webkit.org/show_bug.cgi?id=135379
Does not support CORS for resources which redirect: https://bugzilla.mozilla.org/show_bug.cgi?id=1346749

IE10+ does not send cookies when withCredential=true (IE Bug #759587). A workaround is to use a P3P policy
IE10+ does not make a CORS request if port is the only difference (IE Bug #781303)
Android and some old versions of WebKit (that may be found in various webview implementations) do not support Access-Control-Expose-Headers: https://code.google.com/p/android/issues/detail?id=56726
IE11 does not appear to support CORS for images in the canvas element

Data by caniuse.com
Licensed under the Creative Commons Attribution License v4.0.
https://caniuse.com/cors