CORS-safelisted response header

A CORS-safelisted response header (also known as "simple response header") is an HTTP header in a CORS response that it is considered safe to expose to client scripts. Only safelisted response headers are made available to web pages.

By default, the safelist includes the following response headers:

• Cache-Control
• Content-Language
• Content-Length
• Content-Type
• Expires
• Last-Modified
• Pragma

Additional headers can be added to the safelist using Access-Control-Expose-Headers.

Examples

Extending the safelist

You can extend the list of CORS-safelisted response headers by using the Access-Control-Expose-Headers header:

Access-Control-Expose-Headers: X-Custom-Header, Content-Encoding

See also

• HTTP
• HTTP headers
• Access-Control-Expose-Headers
• Related glossary terms:
  • CORS
  • CORS-safelisted request header
  • Forbidden request header
  • Request header