Access-Control-Max-Age

Baseline Widely available

This feature is well established and works across many devices and browser versions. It’s been available across browsers since July 2015.

The HTTP Access-Control-Max-Age response header indicates how long the results of a preflight request (that is, the information contained in the Access-Control-Allow-Methods and Access-Control-Allow-Headers headers) can be cached.

Header type Response header
Forbidden header name No

Syntax

http
Access-Control-Max-Age: <delta-seconds>

Directives

<delta-seconds>

Maximum number of seconds for which the results can be cached as an unsigned non-negative integer. Firefox caps this at 24 hours (86400 seconds). Chromium (prior to v76) caps at 10 minutes (600 seconds). Chromium (starting in v76) caps at 2 hours (7200 seconds). The default value is 5 seconds.

Examples

Cache results of a preflight request for 10 minutes:

http
Access-Control-Max-Age: 600

Specifications

Specification
Fetch Standard
# http-access-control-max-age

Browser compatibility

BCD tables only load in the browser

See also