Access-Control-Max-Age
Specifies how long the results of a CORS preflight request can be cached.
Syntax
Access-Control-Max-Age: <delta-seconds>Example
Access-Control-Max-Age: 3600Description
The Access-Control-Max-Age header indicates how many seconds the browser can cache the result of a CORS preflight request. During this period, the browser does not need to send another preflight for the same resource.
Setting a reasonable value (e.g. 3600 seconds) reduces unnecessary preflight requests and improves performance for API-heavy applications. Some browsers have a maximum limit they enforce regardless of this value.
How real sites send this header
Home-page responses of 503 popular sites from the enterno.io /check catalogue, checked in the last 30 days.
1.8%
(9 of 503) send Access-Control-Max-Age.
Most common values:
86400— 5 sites1728000— 2 sites
See it on: arstechnica.com, yclients.com, crisp.chat, engadget.com, infoq.com
Check if your website sends this header correctly
Check your headers →