CORS: Strict ABNF based Checks on Access-Control-Allow-Headers and Access-Control-Allow-Methods headers

Category: Security
Type: New or changed feature
Status: Enabled by default (Chrome 85)
Intent stage: Prepare to ship

Breaking change: No
Enterprise impact: None
Spec maturity: Published standard
Web Platform Tests: Yes

WPT details: https://wpt.fyi/results/fetch/api/cors?label=master&label=experimental&aligned&q=cors-preflight-response-validation

Summary

Chrome CORS checked Access-Control-Allow-Headers and Access-Control-Allow-Methods headers in a relaxed manner and didn't follow the ABNF that spec defined. After Chrome 85, CORS checks follow the standardized ABNF.

Standards & signals

Specification: https://fetch.spec.whatwg.org/
Firefox: Shipped/Shipping
Safari: Shipped/Shipping
Web developers: No signals
Tracking bug: https://bugs.chromium.org/p/chromium/issues/detail?id=1060504

Ecosystem

Web Platform Tests: https://wpt.fyi/results/?q=cors-preflight-response-validation
Chrome Platform Showcase: https://chrome-platform-showcase.paulkinlan-ea.deno.net/features
GenDN reference: https://gendn.paulkinlan-ea.deno.net/features
chrome.dev demos search: https://www.google.com/search?q=site%3Achrome.dev+CORS%3A%20Strict%20ABNF%20based%20Checks%20on%20Access-Control-Allow-Headers%20and%20Access-Control-Allow-Methods%20headers
MDN Web Docs: https://developer.mozilla.org/en-US/search?q=CORS%3A%20Strict%20ABNF%20based%20Checks%20on%20Access-Control-Allow-Headers%20and%20Access-Control-Allow-Methods%20headers
Baseline status: https://webstatus.dev/?q=CORS%3A%20Strict%20ABNF%20based%20Checks%20on%20Access-Control-Allow-Headers%20and%20Access-Control-Allow-Methods%20headers

Docs: https://bugs.chromium.org/p/chromium/issues/detail?id=1060504

Explainers: https://fetch.spec.whatwg.org/#http-new-header-syntax

View on chromestatus.com