HTTP headers
Access-Control-Expose-Headers HTTP Header Meaning
Access-Control-Expose-Headers lists response headers browser JavaScript may read.
Meaning
The server is exposing additional response header names beyond the simple CORS response headers.
Where it appears
APIs send it when clients need to read headers such as ETag, Location, or rate-limit fields.
What to check
Check that only useful, non-sensitive headers are exposed.
Example
Access-Control-Expose-Headers: ETag, Location