DevToolsmith

Access-Control-Expose-Headers Header

The Access-Control-Expose-Headers response header lets JavaScript read extra response headers from a cross-origin response.

Type
Response header
Category
CORS
Defined in
Fetch Standard

Syntax

Access-Control-Expose-Headers: <header>, <header>  |  *

How Access-Control-Expose-Headers works

By default, cross-origin JavaScript can only read a few response headers: Cache-Control, Content-Language, Content-Length, Content-Type, Expires, Last-Modified and Pragma. Anything else, such as a pagination Link or an X-Request-Id, comes back as null from response.headers.get() unless it is listed here.

Examples

Expose pagination and tracing headers
Access-Control-Expose-Headers: Link, X-Total-Count, X-Request-Id

Check it

curl -sI https://example.com | grep -i '^access-control-expose-headers:'

Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.

Related headers

  • Access-Control-Allow-Headers: lists the request headers a cross-origin request may send, in answer to a preflight.
  • Access-Control-Allow-Origin: tells the browser which origin may read a cross-origin response.
  • Link: expresses links in a header: preload hints, preconnects, pagination and canonical URLs.

More cors headers

Access-Control-Allow-Credentials , Access-Control-Allow-Methods , Access-Control-Max-Age , Origin .

Sources

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions

What does the Access-Control-Expose-Headers header do?

The Access-Control-Expose-Headers response header lets JavaScript read extra response headers from a cross-origin response. By default, cross-origin JavaScript can only read a few response headers: Cache-Control, Content-Language, Content-Length, Content-Type, Expires, Last-Modified and Pragma. Anything else, such as a pagination Link or an X-Request-Id, comes back as null from response.headers.get() unless it is listed here.

How do I see the Access-Control-Expose-Headers header?

Run "curl -sI https://example.com" to print a response’s headers, or open the Network tab in your browser’s dev tools and select the request. Paste the headers into the HTTP header checker on this site to get each one explained.