CORS
The cross-origin negotiation. A small, closed set of headers that decide whether a browser is allowed to see a response it already received.
13 headers, ordered by how many providers in the catalog declare them.
Access-Control-Allow-Origin
30 providers
regulated
A wildcard on an authenticated surface is a data-protection failure anyone can observe without credentials.
Access-Control-Allow-Methods
16 providers
The Access-Control-Allow-Methods HTTP header — cors, declared by 16 providers in the API Evangelist catalog.
Access-Control-Allow-Headers
16 providers
The Access-Control-Allow-Headers HTTP header — cors, declared by 16 providers in the API Evangelist catalog.
Origin
14 providers
2 spellings
The Origin HTTP header — cors, RFC 6454, declared by 14 providers in the API Evangelist catalog.
Access-Control-Allow-Credentials
11 providers
The Access-Control-Allow-Credentials HTTP header — cors, declared by 11 providers in the API Evangelist catalog.
Access-Control-Expose-Headers
4 providers
2 spellings
The Access-Control-Expose-Headers HTTP header — cors, declared by 4 providers in the API Evangelist catalog.
Access-Control-Max-Age
1 providers
The Access-Control-Max-Age HTTP header — cors, declared by 1 providers in the API Evangelist catalog.
Timing-Allow-Origin
The Timing-Allow-Origin HTTP header — cors, not observed in the catalog.
Method-Check
The Method-Check HTTP header — cors, not observed in the catalog.
Method-Check-Expires
The Method-Check-Expires HTTP header — cors, not observed in the catalog.
Access-Control
The Access-Control HTTP header — cors, not observed in the catalog.
Access-Control-Request-Method
The Access-Control-Request-Method HTTP header — cors, not observed in the catalog.
Access-Control-Request-Headers
The Access-Control-Request-Headers HTTP header — cors, not observed in the catalog.