The Access-Control-Expose-Headers
response header indicates which headers can be exposed as part of the response by listing their names.
By default, only the 7 CORS-safelisted response headers are exposed:
If you want clients to be able to access other headers, you have to list them using the Access-Control-Expose-Headers
header.
Header type | Response header |
---|---|
Forbidden header name | no |
Syntax
Access-Control-Expose-Headers: <header-name>, <header-name>, ... Access-Control-Expose-Headers: *
Directives
- <header-name>
- A list of exposed headers consisting of zero or more header names other than the CORS-safelisted request headers that the resource might use and can be exposed.
*
(wildcard)- The value "
*
" only counts as a special wildcard value for requests without credentials (requests without HTTP cookies or HTTP authentication information). In requests with credentials, it is treated as the literal header name "*
" without special semantics.
Note that theAuthorization
header can't be wildcarded and always needs to be listed explicitly.
Examples
To expose a non-CORS-safelisted request header, you can specify:
Access-Control-Expose-Headers: Content-Length
To additionally expose a custom header, like X-Kuma-Revision
, you can specify multiple headers separated by a comma:
Access-Control-Expose-Headers: Content-Length, X-Kuma-Revision
In requests without credentials, you can also use a wildcard value:
Access-Control-Expose-Headers: *
However, this won't wildcard the Authorization
header, so if you need to expose that, you will need to list it explicitly:
Access-Control-Expose-Headers: *, Authorization
Specifications
Specification | Status | Comment |
---|---|---|
Fetch The definition of 'Access-Control-Expose-Headers' in that specification. |
Living Standard |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Desktop | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Access-Control-Expose-Headers | Chrome Full support 4 | Edge Full support 12 | Firefox Full support 3.5 | IE Full support 10 | Opera Full support 12 | Safari Full support 4 | WebView Android Full support 2 | Chrome Android Full support Yes | Firefox Android Full support 4 | Opera Android Full support 12 | Safari iOS Full support 3.2 | Samsung Internet Android Full support Yes |
Wildcard (* ) | Chrome Full support 65 | Edge Full support 79 | Firefox Full support 69 | IE No support No | Opera Full support 52 | Safari No support No | WebView Android Full support 65 | Chrome Android Full support 65 | Firefox Android No support No | Opera Android Full support 47 | Safari iOS No support No | Samsung Internet Android Full support 9.0 |
Legend
- Full support
- Full support
- No support
- No support