Browser & Web Performance · Middle · Question 49 of 75
Your JS can't read a custom X-Total-Count header from a cross-origin response. Why?
- ✓Correct answer: Only safelisted response headers are exposed; the server must list others in
Access-Control-Expose-Headers - 2Custom headers are always stripped by the browser
- 3The header must be sent in lowercase
Explanation
Headers like Content-Type are readable by default. Pagination or rate-limit headers need explicit exposure.