{{HTTPSidebar}}
The Access-Control-Expose-Headers
response header indicates which headers can be exposed as part of the response by listing their names.
By default, only the 6 {{Glossary("Simple response header", "simple response headers")}} are exposed:
- {{HTTPHeader("Cache-Control")}}
- {{HTTPHeader("Content-Language")}}
- {{HTTPHeader("Content-Type")}}
- {{HTTPHeader("Expires")}}
- {{HTTPHeader("Last-Modified")}}
- {{HTTPHeader("Pragma")}}
If you want clients to be able to access other headers, you have to list them using the Access-Control-Expose-Headers
header.
Header type | {{Glossary("Response header")}} |
---|---|
{{Glossary("Forbidden header name")}} | no |
Syntax
Access-Control-Expose-Headers: <header-name>, <header-name>, ...
Directives
- <header-name>
- A list of exposed headers consisting of zero or more header names other than the {{Glossary("Simple response header", "simple response headers")}} that the resource might use and can be exposed.
Examples
To expose a non-simple response header, you can specify:
Access-Control-Expose-Header: Content-Length
To additionally expose a custom header, like X-Kuma-Revision
, you can specify mulitple headers separated by a comma:
Access-Control-Expose-Header: Content-Length, X-Kuma-Revision
Specifications
Specification | Status | Comment |
---|---|---|
{{SpecName('Fetch','#http-access-control-expose-headers', 'Access-Control-Expose-Headers')}} | {{Spec2("Fetch")}} |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
{{Compat}}
Compatibility notes
- The wildcard value (*) that is mentioned in the latest specification, is not yet implemented in browsers:
- Chromium: Issue 615313
- Firefox: {{bug(1309358)}}
- Servo: Issue 13283
See also
- {{HTTPHeader("Access-Control-Allow-Headers")}}
- {{HTTPHeader("Access-Control-Allow-Origin")}}