Access-Control-Expose-Headers
Response headers that cross-origin JavaScript may read.
Response header (sent by servers) cors
How it works
By default only a few safe headers are visible to cross-origin code. List others, such as ETag or X-Request-Id, here.
Example
Access-Control-Expose-Headers: ETag, X-Request-Id
See it live: send any request in Endpoint Client and open the Headers tab, where every response header is explained. Specification: Fetch Standard.
Related headers
Access-Control-Allow-Credentials
Whether the browser may expose the response when the request carried cookies or auth.
Access-Control-Allow-Headers
Request headers a cross-origin page may send.
Access-Control-Allow-Methods
Methods a cross-origin page may use.
Access-Control-Allow-Origin
Which web origin may read this response from browser JavaScript.
Access-Control-Max-Age
How long the browser may cache a preflight result, in seconds.
Origin
The web origin that initiated the request.