Cross-Origin Resource Sharing

Method of performing XMLHttpRequests across domains

Spec	https://fetch.spec.whatwg.org/#http-cors-protocol
Status	WHATWG Living Standard

IE	Edge	Firefox	Chrome	Safari	Opera
			103
		100	102
		99	101	TP ⁽³⁾
11	99	98	100	15.4 ⁽³⁾	83
10 ⁽¹⁾	98	97	99	15.2-15.3 ⁽³⁾	82
9 ⁽²⁾	97	96	98	15.1 ⁽³⁾	81
8 ⁽²⁾	96	95	97	15 ⁽³⁾	80
Show all
7	95	94	96	14.1 ⁽³⁾	79
6	94	93	95	14 ⁽³⁾	78
5.5	93	92	94	13.1 ⁽³⁾	77
	92	91	93	13 ⁽³⁾	76
	91	90	92	12.1 ⁽³⁾	75
	90	89	91	12 ⁽³⁾	74
	89	88	90	11.1 ⁽³⁾	73
	88	87	89	11 ⁽³⁾	72
	87	86	88	10.1 ⁽³⁾	71
	86	85	87	10 ⁽³⁾	70
	85	84	86	9.1 ⁽³⁾	69
	84	83	85	9 ⁽³⁾	68
	83	82	84	8 ⁽³⁾	67
	81	81	83	7.1 ⁽³⁾	66
	80	80	81	7 ⁽³⁾	65
	79	79	80	6.1 ⁽³⁾	64
	18	78	79	6 ⁽³⁾	63
	17	77	78	5.1 ^(1,3)	62
	16	76	77	5 ^(1,3)	60
	15	75	76	4 ^(1,3)	58
	14	74	75	3.2	57
	13	73	74	3.1	56
	12	72	73		55
		71	72		54
		70 ⁽⁴⁾	71		53
		69 ⁽⁴⁾	70		52
		68 ⁽⁴⁾	69		51
		67 ⁽⁴⁾	68		50
		66 ⁽⁴⁾	67		49
		65 ⁽⁴⁾	66		48
		64 ⁽⁴⁾	65		47
		63 ⁽⁴⁾	64		46
		62 ⁽⁴⁾	63		45
		61 ⁽⁴⁾	62		44
		60	61		43
		59	60		42
		58	59		41
		57	58		40
		56	57		39
		55	56		38
		54	55		37
		53	54		36
		52	53		35
		51	52		34
		50	51		33
		49	50		32
		48	49		31
		47	48		30
		46	47		29
		45	46		28
		44	45		27
		43	44		26
		42	43		25
		41	42		24
		40	41		23
		39	40		22
		38	39		21
		37	38		20
		36	37		19
		35	36		18
		34	35		17
		33	34		16
		32	33		15
		31	32		12.1
		30	31		12
		29	30		11.6
		28	29		11.5
		27	28		11.1
		26	27		11
		25	26		10.6
		24	25		10.5
		23	24		10.0-10.1
		22	23		9.5-9.6
		21	22		9
		20	21
		19	20
		18	19
		17	18
		16	17
		15	16
		14	15
		13	14
		12	13
		11	12 ⁽¹⁾
		10	11 ⁽¹⁾
		9	10 ⁽¹⁾
		8	9 ⁽¹⁾
		7	8 ⁽¹⁾
		6	7 ⁽¹⁾
		5	6 ⁽¹⁾
		4	5 ⁽¹⁾
		3.6	4 ⁽¹⁾
		3.5
		3
		2

Notes

Does not support CORS for images in <canvas>
Supported somewhat in IE8 and IE9 using the XDomainRequest object (but has limitations)
Does not support CORS for <video> in <canvas>: https://bugs.webkit.org/show_bug.cgi?id=135379
Does not support CORS for resources which redirect: https://bugzilla.mozilla.org/show_bug.cgi?id=1346749

IE10+ does not send cookies when withCredential=true (IE Bug #759587). A workaround is to use a P3P policy
IE10+ does not make a CORS request if port is the only difference (IE Bug #781303)
Android and some old versions of WebKit (that may be found in various webview implementations) do not support Access-Control-Expose-Headers: https://code.google.com/p/android/issues/detail?id=56726
IE11 does not appear to support CORS for images in the canvas element

Data by caniuse.com
Licensed under the Creative Commons Attribution License v4.0.
https://caniuse.com/cors