Skip to content

CORS: Retry-After header not exposed, browser JS can't honor 429 back-off #322

@CryptoJones

Description

@CryptoJones

express-rate-limit (standardHeaders: true) sets Retry-After on the 429 response. Browser JS reading the response across CORS can't see headers outside the CORS-safelisted set unless the server explicitly exposes them via Access-Control-Expose-Headers.

Retry-After is NOT on the CORS safelist, so fetch().headers.get('Retry-After') returns null on a 429 from a cross-origin client. Without it, clients fall back to fixed-delay retry instead of honoring the server's back-off.

Fix: add 'Retry-After' to server.js exposedHeaders. Update tests/api/cors-expose-headers.test.js to mirror the entry. Add an assertion in tests/api/rate-limit.test.js confirming the 429 response actually carries the header.

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions