Web Security · Middle · Question 36 of 75

By default, which response headers can front-end code read from a cross-origin response?

1None at all
✓Correct answer: Only CORS-safelisted ones like Content-Type; others need Access-Control-Expose-Headers
3All headers, as long as CORS succeeded

Explanation

For example, to read a custom X-Request-Id or Link header, the server must list it in Access-Control-Expose-Headers.

Further reading

MDN: CORS ↗

Test yourself

Take the Web Security · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.