Access-Control-Expose-Headers response header indicates which headers can be exposed as part of the response by listing their names.
By default, only the 6 simple response headers are exposed:
If you want clients to be able to access other headers, you have to list them using the
|Header type||Response header|
|Forbidden header name||no|
Access-Control-Expose-Headers: <header-name>, <header-name>, ...
- A list of exposed headers consisting of zero or more header names other than the simple response headers that the resource might use and can be exposed.
To expose a non-simple response header, you can specify:
To additionally expose a custom header, like
X-Kuma-Revision, you can specify multiple headers separated by a comma:
Access-Control-Expose-Headers: Content-Length, X-Kuma-Revision
The definition of 'Access-Control-Expose-Headers' in that specification.
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
|Chrome Full support 4||Edge Full support 12||Firefox Full support 3.5||IE Full support 10||Opera Full support 12||Safari Full support 4||WebView Android Full support 2||Chrome Android Full support Yes||Firefox Android Full support 4||Opera Android Full support 12||Safari iOS Full support 3.2||Samsung Internet Android Full support Yes|
- Full support
- Full support
- The wildcard value (*) that is mentioned in the latest specification, is not yet implemented in browsers: