CORS: Strict ABNF based Checks on Access-Control-Allow-Headers and Access-Control-Allow-Methods headers

Chrome CORS checked Access-Control-Allow-Headers and Access-Control-Allow-Methods headers in a relaxed manner and didn't follow the ABNF that spec defined. After Chrome 85, CORS checks follow the standardized ABNF.

Documentation

Specification

Established standard

Status in Chromium

Internals>Services>Network


Enabled by default (tracking bug) in:

  • Chrome for desktop release 85
  • Chrome for Android release 85
  • Android WebView release 85

Consensus & Standardization

After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.

  • Shipped/Shipping
  • Shipped/Shipping
  • Shipped/Shipping
  • No signals

Owners

Intent to Prototype url

Intent to Prototype thread

Search tags

CORS,

Last updated on 2020-10-06