Access-Control-Max-Age

Preflight requests add latency to every cross-origin call. The Access-Control-Max-Age response header specifies how long, in seconds, the results of a CORS preflight request are cached by the browser.

Table of Contents

Usage
Values
- Seconds
- -1
Example
See also

Usage

A preflight OPTIONS request adds latency to every cross-origin call. The Access-Control-Max-Age header reduces this cost by telling the browser to reuse the preflight result for a given number of seconds. During the cache window, the browser skips the preflight step and sends the actual request directly.

The cache stores separate entries keyed on the request URL and Origin, one per method and one per header name from Access-Control-Request-Method and Access-Control-Request-Headers, plus the credentials mode of the request. A method or header without a matching entry triggers a fresh preflight.

When the header is absent, browsers apply a short default of five seconds. Each browser also caps the value: Chromium-based browsers cap it at 7200 seconds (2 hours) and Firefox at 86400 seconds (24 hours), regardless of a larger value sent by the server. A value above the cap is clamped, so the 86400 example below reuses the preflight for 2 hours on Chromium browsers.

Values

Seconds

A non-negative integer representing the number of seconds the preflight result remains valid.

Access-Control-Max-Age: 86400

-1

A value of -1 disables caching in Chromium-based browsers and matching implementations, forcing a preflight request before every cross-origin call, a vendor convention beyond the Fetch Standard. This is useful during development or when server policy changes frequently.

Access-Control-Max-Age: -1

Example

A server returns a preflight response allowing PUT and DELETE methods with a 24-hour cache window. The browser reuses this result for subsequent requests to the same endpoint from the same origin.

HTTP/1.1 204 No Content
Access-Control-Allow-Origin: https://app.example.re
Access-Control-Allow-Methods: GET, PUT, DELETE
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 86400
Vary: Origin

A shorter cache window of 10 minutes suits APIs where permissions change more often.

Access-Control-Max-Age: 600