The Access-Control-Expose-Headers response header indicates which headers can be exposed as part of the response by listing their names.
By default, only the 6 simple response headers are exposed:
If you want clients to be able to access other headers, you have to list them using the Access-Control-Expose-Headers header.
| Header type | Response header |
|---|---|
| Forbidden header name | no |
Syntax
Access-Control-Expose-Headers: <header-name>, <header-name>, ...
Directives
- <header-name>
- A list of exposed headers consisting of zero or more header names other than the simple response headers that the resource might use and can be exposed.
Examples
To expose a non-simple response header, you can specify:
Access-Control-Expose-Header: Content-Length
To additionally expose a custom header, like X-Kuma-Revision, you can specify multiple headers separated by a comma:
Access-Control-Expose-Header: Content-Length, X-Kuma-Revision
Specifications
| Specification | Status | Comment |
|---|---|---|
| Fetch The definition of 'Access-Control-Expose-Headers' in that specification. |
Living Standard |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
| Feature | Chrome | Edge | Firefox | Internet Explorer | Opera | Safari | Servo |
|---|---|---|---|---|---|---|---|
| Access-Control-Expose-Headers | 4 | 12 | 3.5 | 10 | 12 | 4 | ? |
| Feature | Android | Chrome for Android | Edge Mobile | Firefox for Android | IE Mobile | Opera Mobile | Safari Mobile |
|---|---|---|---|---|---|---|---|
| Access-Control-Expose-Headers | 2.1 | (Yes) | (Yes) | 1.0 | (Yes) | 12 | 3.2 |
Compatibility notes
- The wildcard value (*) that is mentioned in the latest specification, is not yet implemented in browsers:
- Chromium: Issue 615313
- Firefox: bug 1309358
- Servo: Issue 13283