The Access-Control-Allow-Methods response header specifies the method or methods allowed when accessing the resource in response to a preflight request.
| Header type | Response header |
|---|---|
| Forbidden header name | no |
Syntax
Access-Control-Allow-Methods: <method>, <method>, ...
Directives
- <method>
- Comma-delimited list of the allowed HTTP request methods.
Examples
Access-Control-Allow-Methods: POST, GET, OPTIONS
Specifications
| Specification | Status | Comment |
|---|---|---|
| Fetch The definition of 'Access-Control-Allow-Methods' in that specification. |
Living Standard | Initial definition |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
| Feature | Chrome | Edge | Firefox | Internet Explorer | Opera | Safari | Servo |
|---|---|---|---|---|---|---|---|
| Access-Control-Allow-Methods | 4 | 12 | 3.5 | 10 | 12 | 4 | ? |
Compatibility notes
- The wildcard value (*) that is mentioned in the latest specification, is not yet implemented in browsers:
- Chromium: Issue 615313
- Firefox: bug 1309358
- Servo: Issue 13283