Policy
CORS non-wildcard request header support enabled
Microsoft Edge
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows7
This policy lets you configure support for CORS non-wildcard request headers. Microsoft Edge version 97 introduces support for CORS non-wildcard request headers. When a script makes a cross-origin network request via fetch() and XMLHttpRequest with a script-added Authorization header, the header is explicitly allowed by the Access-Control-Allow-Headers header in the CORS preflight response. "Explicitly" here means that the wild card symbol "*" doesn't cover the Authorization header. For more information, see https://go.microsoft.com/fwlink/?linkid=2180022. If you enable or don't configure the policy, Microsoft Edge supports the CORS non-wildcard request headers and behaves as previously described. If you disable this policy, Microsoft Edge allows the wildcard symbol ("*") in the Access-Control-Allow-Headers header in the CORS preflight response to cover the Authorization header. This policy is a temporary workaround for the new CORS non-wildcard request header feature. It's planned to be removed in the future.
Registry values
How enabled and disabled states update the registry.
| Scope | Registry location | Type | Enabled value | Disabled value | Copy |
|---|---|---|---|---|---|
Path Software\Policies\Microsoft\Edge Value name CORSNonWildcardRequestHeadersSupport | REG_DWORD | HKLM 1 HKCU 1 | HKLM 0 HKCU 0 |
Policy elements
Inputs and configuration options exposed by this policy.
This policy has no additional user input fields.