POST request method - HTTP | MDN
Skip to main content
Skip to search
MDN
HTML
HTML: Markup language
HTML reference
Elements
Global attributes
Attributes
See all…
HTML guides
Responsive images
HTML cheatsheet
Date & time formats
See all…
Markup languages
SVG
MathML
XML
CSS
CSS: Styling language
CSS reference
Properties
Selectors
At-rules
Values
See all…
CSS guides
Box model
Animations
Flexbox
Colors
See all…
Layout cookbook
Column layouts
Centering an element
Card component
See all…
JavaScriptJS
JavaScript: Scripting language
JS reference
Standard built-in objects
Expressions & operators
Statements & declarations
Functions
See all…
JS guides
Control flow & error handing
Loops and iteration
Working with objects
Using classes
See all…
Web APIs
Web APIs: Programming interfaces
Web API reference
File system API
Fetch API
Geolocation API
HTML DOM API
Push API
Service worker API
See all…
Web API guides
Using the Web animation API
Using the Fetch API
Working with the History API
Using the Web speech API
Using web workers
All
All web technology
Technologies
Accessibility
HTTP
URI
Web extensions
WebAssembly
WebDriver
See all…
Topics
Media
Performance
Privacy
Security
Progressive web apps
Learn
Learn web development
Frontend developer course
Getting started modules
Core modules
MDN Curriculum
Check out the video course from Scrimba, our partner
Learn HTML
Structuring content with HTML module
Learn CSS
CSS styling basics module
CSS layout module
Learn JavaScript
Dynamic scripting with JavaScript module
Tools
Discover our tools
Playground
HTTP Observatory
Border-image generator
Border-radius generator
Box-shadow generator
Color format converter
Color mixer
Shape generator
About
Get to know MDN better
About MDN
Advertise with us
Community
MDN on GitHub
Blog
Toggle sidebar
Web
HTTP
Reference
Request methods
POST
Theme
OS default
Light
Dark
English (US)
Remember language
Learn more
Deutsch
English (US)
Español
Français
日本語
한국어
Português (do Brasil)
Русский
中文 (简体)
正體中文 (繁體)
POST request method
Baseline
Widely available
This feature is well established and works across many devices and browser versions. It’s been available across browsers since July 2015.
Learn more
See full compatibility
The POST HTTP method sends data to the server. The type of the body of the request is indicated by the Content-Type header.
The difference between PUT and POST is that PUT is idempotent: calling it once is no different from calling it several times successively (there are no side effects).
Successive identical POST requests may have additional effects, such as creating the same order several times.
HTML forms typically send data using POST and this usually results in a change on the server.
For HTML forms the format/encoding of the body content is determined by the enctype attribute of the <form> element or the formenctype attribute of the <input> or <button> elements.
The encoding may be one of the following:
application/x-www-form-urlencoded: the keys and values are encoded in key-value tuples separated by an ampersand (&), with an equals symbol (=) between the key and the value (e.g., first-name=Frida&last-name=Kahlo).
Non-alphanumeric characters in both keys and values are percent-encoded: this is the reason why this type is not suitable to use with binary data and you should use multipart/form-data for this purpose instead.
multipart/form-data: each value is sent as a block of data ("body part"), with a user agent-defined delimiter (for example, boundary="delimiter12345") separating each part.
The keys are described in the Content-Disposition header of each part or block of data.
text/plain
When the POST request is sent following a fetch() call, or for any other reason than an HTML form, the body can be any type.
As described in the HTTP 1.1 specification, POST is designed to allow a uniform method to cover the following functions:
Annotation of existing resources
Posting a message to a bulletin board, newsgroup, mailing list, or similar group of articles
Adding a new user through a signup form
Providing a block of data, such as the result of submitting a form, to a data-handling process
Extending a database through an append operation
Request has body
Yes
Successful response has body
Yes
Safe
No
Idempotent
No
Cacheable
Only if freshness information is included
Allowed in HTML forms
Yes
In this article
Syntax
Examples
Specifications
Browser compatibility
See also
Syntax
http
POST <request-target>["?"<query>] HTTP/1.1
<request-target>
Identifies the target resource of the request when combined with the information provided in the Host header.
This is an absolute path (e.g., /path/to/file.html) in requests to an origin server, and an absolute URL in requests to proxies (e.g., http://www.example.com/path/to/file.html).
<query> Optional
An optional query component preceded by a question-mark ?.
Often used to carry identifying information in the form of key=value pairs.
Examples
URL-encoded form submission
A form using application/x-www-form-urlencoded content encoding (the default) sends a request where the body contains the form data in key=value pairs, with each pair separated by an & symbol, as shown below:
http
POST /test HTTP/1.1
Host: example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 27
field1=value1&field2=value2
Multipart form submission
The multipart/form-data encoding is used when a form includes files or a lot of data.
This request body delineates each part of the form using a boundary string.
An example of a request in this format:
http
POST /test HTTP/1.1
Host: example.com
Content-Type: multipart/form-data;boundary="delimiter12345"
--delimiter12345
Content-Disposition: form-data; name="field1"
value1
--delimiter12345
Content-Disposition: form-data; name="field2"; filename="example.txt"
value2
--delimiter12345--
The Content-Disposition header indicates how the form data should be processed, specifying the field name and filename, if appropriate.
Specifications
Specification
HTTP Semantics
# POST
Browser compatibility
Enable JavaScript to view this browser compatibility table.
See also
HTTP request methods
HTTP response status codes
HTTP headers
Content-Type header
Content-Disposition header
GET method
Help improve MDN
Was this page helpful to you?
Yes
No
Learn how to contribute
This page was last modified on Jul 4, 2025 by MDN contributors.
View this page on GitHub • Report a problem with this content
Filter sidebar
Clear filter input
HTTP
Guides
Overview of HTTP
Evolution of HTTP
A typical HTTP session
HTTP messages
Media types
Common types
Compression in HTTP
HTTP caching
HTTP authentication
Using HTTP cookies
Redirections in HTTP
Conditional requests
Range requests
Client hints
User-Agent reduction
Compression Dictionary Transport
Network Error Logging
Content negotiation
Default Accept values
Browser detection using the UA string
Connection management in HTTP/1.x
Protocol upgrade mechanism
Proxy servers and tunneling
Proxy Auto-Configuration (PAC) file
Security and privacy
HTTP Observatory
Practical implementation guides
Permissions Policy
Cross-Origin Resource Policy (CORP)
IFrame credentialless
Fetch metadata
Cross-Origin Resource Sharing (CORS)
CORS errors
Reason: CORS disabled
Reason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'
Reason: CORS header 'Access-Control-Allow-Origin' missing
Reason: CORS header 'Origin' cannot be added
Reason: CORS preflight channel did not succeed
Reason: CORS request did not succeed
Reason: CORS request external redirect not allowed
Reason: CORS request not HTTP
Reason: Credential is not supported if the CORS header 'Access-Control-Allow-Origin' is '*'
Reason: Did not find method in CORS header 'Access-Control-Allow-Methods'
Reason: expected 'true' in CORS header 'Access-Control-Allow-Credentials'
Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'
Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Methods'
Reason: missing token 'xyz' in CORS header 'Access-Control-Allow-Headers' from CORS preflight channel
Reason: Multiple CORS header 'Access-Control-Allow-Origin' not allowed
Content Security Policy (CSP)
Errors and warnings
Reference
HTTP headers
Accept
Accept-CH
Accept-Encoding
Accept-Language
Accept-Patch
Accept-Post
Accept-Ranges
Access-Control-Allow-Credentials
Access-Control-Allow-Headers
Access-Control-Allow-Methods
Access-Control-Allow-Origin
Access-Control-Expose-Headers
Access-Control-Max-Age
Access-Control-Request-Headers
Access-Control-Request-Method
Activate-Storage-Access
Age
Allow
Alt-Svc
Alt-Used
Attribution-Reporting-Eligible
Attribution-Reporting-Register-Source
Attribution-Reporting-Register-Trigger
Authorization
Available-Dictionary
Cache-Control
Clear-Site-Data
Connection
Content-Digest
Content-Disposition
Content-DPR
Content-Encoding
Content-Language
Content-Length
Content-Location
Content-Range
Content-Security-Policy
Content-Security-Policy-Report-Only
Content-Type
Cookie
Critical-CH
Cross-Origin-Embedder-Policy
Cross-Origin-Embedder-Policy-Report-Only
Cross-Origin-Opener-Policy
Cross-Origin-Resource-Policy
Date
Device-Memory
Dictionary-ID
DNT
Downlink
DPR
Early-Data
ECT
ETag
Expect
Expect-CT
Expires
Forwarded
From
Host
Idempotency-Key
If-Match
If-Modified-Since
If-None-Match
If-Range
If-Unmodified-Since
Integrity-Policy
Integrity-Policy-Report-Only
Keep-Alive
Last-Modified
Link
Location
Max-Forwards
NEL
No-Vary-Search
Observe-Browsing-Topics
Origin
Origin-Agent-Cluster
Permissions-Policy
Permissions-Policy-Report-Only
Pragma
Prefer
Preference-Applied
Priority
Proxy-Authenticate
Proxy-Authorization
Range
Referer
Referrer-Policy
Refresh
Report-To
Reporting-Endpoints
Repr-Digest
Retry-After
RTT
Save-Data
Sec-Browsing-Topics
Sec-CH-Device-Memory
Sec-CH-DPR
Sec-CH-Prefers-Color-Scheme
Sec-CH-Prefers-Reduced-Motion
Sec-CH-Prefers-Reduced-Transparency
Sec-CH-UA
Sec-CH-UA-Arch
Sec-CH-UA-Bitness
Sec-CH-UA-Form-Factors
Sec-CH-UA-Full-Version
Sec-CH-UA-Full-Version-List
Sec-CH-UA-Mobile
Sec-CH-UA-Model
Sec-CH-UA-Platform
Sec-CH-UA-Platform-Version
Sec-CH-UA-WoW64
Sec-CH-Viewport-Height
Sec-CH-Viewport-Width
Sec-CH-Width
Sec-Fetch-Dest
Sec-Fetch-Mode
Sec-Fetch-Site
Sec-Fetch-Storage-Access
Sec-Fetch-User
Sec-GPC
Sec-Private-State-Token
Sec-Private-State-Token-Crypto-Version
Sec-Private-State-Token-Lifetime
Sec-Purpose
Sec-Redemption-Record
Sec-Speculation-Tags
Sec-WebSocket-Accept
Sec-WebSocket-Extensions
Sec-WebSocket-Key
Sec-WebSocket-Protocol
Sec-WebSocket-Version
Server
Server-Timing
Service-Worker
Service-Worker-Allowed
Service-Worker-Navigation-Preload
Set-Cookie
Set-Login
SourceMap
Speculation-Rules
Strict-Transport-Security
Supports-Loading-Mode
TE
Timing-Allow-Origin
Tk
Trailer
Transfer-Encoding
Upgrade
Upgrade-Insecure-Requests
Use-As-Dictionary
User-Agent
Vary
Via
Viewport-Width
Want-Content-Digest
Want-Repr-Digest
Warning
Width
WWW-Authenticate
X-Content-Type-Options
X-DNS-Prefetch-Control
X-Forwarded-For
X-Forwarded-Host
X-Forwarded-Proto
X-Frame-Options
X-Permitted-Cross-Domain-Policies
X-Powered-By
X-Robots-Tag
X-XSS-Protection
HTTP request methods
CONNECT
DELETE
GET
HEAD
OPTIONS
PATCH
POST
PUT
TRACE
HTTP response status codes
100 Continue
101 Switching Protocols
102 Processing
103 Early Hints
200 OK
201 Created
202 Accepted
203 Non-Authoritative Information
204 No Content
205 Reset Content
206 Partial Content
207 Multi-Status
208 Already Reported
226 IM Used
300 Multiple Choices
301 Moved Permanently
302 Found
303 See Other
304 Not Modified
307 Temporary Redirect
308 Permanent Redirect
400 Bad Request
401 Unauthorized
402 Payment Required
403 Forbidden
404 Not Found
405 Method Not Allowed
406 Not Acceptable
407 Proxy Authentication Required
408 Request Timeout
409 Conflict
410 Gone
411 Length Required
412 Precondition Failed
413 Content Too Large
414 URI Too Long
415 Unsupported Media Type
416 Range Not Satisfiable
417 Expectation Failed
418 I'm a teapot
421 Misdirected Request
422 Unprocessable Content
423 Locked
424 Failed Dependency
425 Too Early
426 Upgrade Required
428 Precondition Required
429 Too Many Requests
431 Request Header Fields Too Large
451 Unavailable For Legal Reasons
500 Internal Server Error
501 Not Implemented
502 Bad Gateway
503 Service Unavailable
504 Gateway Timeout
505 HTTP Version Not Supported
506 Variant Also Negotiates
507 Insufficient Storage
508 Loop Detected
510 Not Extended
511 Network Authentication Required
CSP directives
base-uri
block-all-mixed-content
child-src
connect-src
default-src
fenced-frame-src
font-src
form-action
frame-ancestors
frame-src
img-src
manifest-src
media-src
object-src
prefetch-src
report-to
report-uri
require-trusted-types-for
sandbox
script-src
script-src-attr
script-src-elem
style-src
style-src-attr
style-src-elem
trusted-types
upgrade-insecure-requests
worker-src
Permissions-Policy directives
accelerometer
ambient-light-sensor
aria-notify
attribution-reporting
autoplay
bluetooth
browsing-topics
camera
captured-surface-control
ch-ua-high-entropy-values
compute-pressure
cross-origin-isolated
deferred-fetch
deferred-fetch-minimal
display-capture
encrypted-media
fullscreen
gamepad
geolocation
gyroscope
hid
identity-credentials-get
idle-detection
language-detector
local-fonts
local-network
local-network-access
loopback-network
magnetometer
microphone
midi
on-device-speech-recognition
otp-credentials
payment
picture-in-picture
private-state-token-issuance
private-state-token-redemption
publickey-credentials-create
publickey-credentials-get
screen-wake-lock
serial
speaker-selection
storage-access
summarizer
translator
usb
web-share
window-management
xr-spatial-tracking
HTTP resources and specifications
MDN
Your blueprint for a better internet.
MDN
About
Blog
Mozilla careers
Advertise with us
MDN Plus
Product help
Contribute
MDN Community
Community resources
Writing guidelines
MDN Discord
MDN on GitHub
Developers
Web technologies
Learn web development
Guides
Tutorials
Glossary
Hacks blog
Mozilla
Website Privacy Notice
Telemetry Settings
Legal
Community Participation Guidelines
Portions of this content are ©1998–2026 by individual mozilla.org contributors. Content available under a Creative Commons license.