CORS Headers Référence
Cross-Origin Resource Sharing headers, preflight requests, et credential handling per Récupérer standard.
Core Headers
CORS allows a server to relax the same-origin policy so a browser can make cross-origin requests. The Access-Control-Allow-Origin header specifies which origins may access the resource, either a single origin or the wildcard. The wildcard cannot be combined with credentials, so authenticated cross-origin requests must echo the specific origin. Preflight requests use OPTIONS to negotiate methods and headers before the actual request.
- Allow-Origin
- Permitted origin or wildcard
- Allow-Methods
- Permitted HTTP methods
- Allow-Headers
- Permitted request headers
- Allow-Credentials
- Whether cookies and auth may be sent
- Max-Age
- How long to cache preflight result
https://app.example.comGET, POST, PUTContent-Type, Authorizationtrue86400Preflight Flow
Requests with custom headers, non-simple methods, or non-simple content types trigger a preflight OPTIONS request. The browser sends the requested method and headers in the Access-Control-Request-* headers, and the server responds with the corresponding Allow-* headers. If the preflight fails, the actual request is never sent. Caching preflight results with Max-Age reduces latency for repeated cross-origin calls.
Security Considerations
Reflecting the request Origin header verbatim into Allow-Origin without validation enables any site to access the resource, which is dangerous for authenticated endpoints. The Allow-Credentials true flag combined with a permissive origin allows cross-site data theft. Servers should maintain an allowlist of origins and reject unlisted ones explicitly. CORS is a browser-enforced mechanism and does not protect non-browser clients.