W3cubDocs

/HTTP

Access-Control-Allow-Methods

The Access-Control-Allow-Methods response header specifies the method or methods allowed when accessing the resource in response to a preflight request.

Syntax

Access-Control-Allow-Methods: <method>, <method>, ...
Access-Control-Allow-Methods: *

Directives

<method>
Comma-delimited list of the allowed HTTP request methods.
* (wildcard)
The value "*" only counts as a special wildcard value for requests without credentials (requests without HTTP cookies or HTTP authentication information). In requests with credentials, it is treated as the literal method name "*" without special semantics.

Examples

Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Methods: *

Specifications

Specification Status Comment
Fetch
The definition of 'Access-Control-Allow-Methods' in that specification.
Living Standard Initial definition

Browser compatibilityUpdate compatibility data on GitHub

Desktop
Chrome Edge Firefox Internet Explorer Opera Safari
Access-Control-Allow-Methods 4 12 3.5 10 12 4
Wildcard (*) 63 79 69 No 50 No
Mobile
Android webview Chrome for Android Firefox for Android Opera for Android Safari on iOS Samsung Internet
Access-Control-Allow-Methods 2 Yes 4 12 3.2 Yes
Wildcard (*) 63 63 No 46 No 8.2

See also

© 2005–2020 Mozilla and individual contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods