Access-Control-Expose-Headers
This header specifies which response headers should be exposed to JavaScript in cross-origin requests.
Why It Matters
By default, only simple response headers are exposed. This header controls access to custom headers, which could leak sensitive information if misconfigured.
How We Check
We check which headers are exposed and verify no sensitive information is inadvertently leaked to cross-origin requests.
How to Fix
Only expose headers that cross-origin JavaScript legitimately needs. Avoid exposing authentication tokens or sensitive metadata.
Frequently Asked Questions
What is Access-Control-Expose-Headers?
This header specifies which response headers should be exposed to JavaScript in cross-origin requests.
Why does Access-Control-Expose-Headers matter for website security?
By default, only simple response headers are exposed. This header controls access to custom headers, which could leak sensitive information if misconfigured.
How do I fix Access-Control-Expose-Headers issues?
Only expose headers that cross-origin JavaScript legitimately needs. Avoid exposing authentication tokens or sensitive metadata.
Related Security Checks
Related Tool
CORS Checker
Run all 6 related checks with our free cors checker
Check Your Website Now
Run a free security scan to check for Access-Control-Expose-Headers issues and 62+ other security vulnerabilities.
Scan Your Website Free