The Access-Control-Expose-Headers response header indicates which headers can be exposed as part of the response by listing their names.

By default, only the 6 simple response headers are exposed:

If you want clients to be able to access other headers, you have to list them using the Access-Control-Expose-Headers header.

Header type Response header
Forbidden header name no


Access-Control-Expose-Headers: <header-name>, <header-name>, ...


A list of exposed headers consisting of zero or more header names other than the simple response headers that the resource might use and can be exposed.


To expose a non-simple response header, you can specify:

Access-Control-Expose-Header: Content-Length

To additionally expose a custom header, like X-Kuma-Revision, you can specify multiple headers separated by a comma:

Access-Control-Expose-Header: Content-Length, X-Kuma-Revision


Specification Status Comment
The definition of 'Access-Control-Expose-Headers' in that specification.
Living Standard  

Browser compatibility

Feature Chrome Edge Firefox Internet Explorer Opera Safari Servo
Basic Support4123.510124?
Feature Android Chrome for Android Edge Mobile Firefox for Android IE Mobile Opera Mobile Safari Mobile
Basic Support2.1(Yes)(Yes)1.0(Yes)123.2

Compatibility notes

See also

Document Tags and Contributors

 Contributors to this page: fscholz
 Last updated by: fscholz,