devkult_
tools29converters34
home/headers/access-control-expose-headers

Access-Control-Expose-Headers

response headercors

Lists the response headers that JavaScript on another origin is allowed to read.

A cross-origin fetch can only read seven CORS-safelisted response headers: Cache-Control, Content-Language, Content-Length, Content-Type, Expires, Last-Modified and Pragma. Everything else — Content-Disposition, ETag, Retry-After, X-Total-Count — reads as null in JavaScript, even though DevTools shows it. Listing a header here exposes it.

Syntax

Access-Control-Expose-Headers: <header-name>, <header-name>…

Defined in Fetch Standard — CORS protocol.

Examples

Access-Control-Expose-Headers: Content-Disposition, ETag, X-Total-Count

download names, versions and pagination totals

Access-Control-Expose-Headers: *

every header — only for requests without credentials

Good to know

  • It belongs on the actual response, not the preflight.
  • With credentialed requests, * exposes nothing extra — list the names.
  • If response.headers.get("X-Request-Id") returns null but DevTools shows the header, this is what's missing.

Further reading: CORS errors explained

How to set Access-Control-Expose-Headers

Express
res.set("Access-Control-Expose-Headers", "Content-Disposition, ETag, X-Total-Count");
Next.js (next.config.js)
module.exports = {
  async headers() {
    return [
      {
        source: "/(.*)",
        headers: [{ key: "Access-Control-Expose-Headers", value: "Content-Disposition, ETag, X-Total-Count" }],
      },
    ];
  },
};
nginx
add_header Access-Control-Expose-Headers "Content-Disposition, ETag, X-Total-Count" always;
Apache (.htaccess)
Header always set Access-Control-Expose-Headers "Content-Disposition, ETag, X-Total-Count"

Check it

Fetch only the response headers and filter for Access-Control-Expose-Headers. In the browser, it's under Response Headers in DevTools → Network.

curl -sI https://example.com/ | grep -i '^access-control-expose-headers:'

To compare response headers across many URLs at once, use the HTTP Status Checker.

Frequently asked questions

Why does response.headers.get() return null when DevTools shows the header?

DevTools shows everything the server sent. JavaScript on another origin only sees the safelisted headers plus those named in Access-Control-Expose-Headers.

Related headers