Access-Control-Expose-Headers

[ix-xerri]

Would just like to double check this issue. In my use case I have a CSRF token in the headers. Now to have that token accessible by the client then I need to use 'Access-Control-Expose-Headers'. This middle ware does not offer the functionality to add that header, correct?

[troygoode]

Hi @ix-xerri you're right, that isn't currently supported. I haven't seen this header before, but I'll take a look at implementing it soon.

http://www.w3.org/TR/cors/#access-control-expose-headers-response-header

[ix-xerri]

Express examples usually show CSRF tokens inside some jade template. I include it in the response header and have the client store it in memory so that the next request would contain the CSRF token. To be able to access the header of a CORS response via javascript you need Access-Control-Expose-Headers
Thanks

[troygoode]

Just received another bug report about this (copy-pasta'd below). Will get this fixed in the next couple of days.

---

Hey, I just thought I would drop you a note. I might have a minor bug fix, but I'm not sure if it strictly relates to CORS. Chrome has been giving me errors for a while - refusing to get unsafe headers. I believe the solution is: Access-Control-Expose-Headers. To make Chrome happy, I did the following:

Config:

var corsOptions = {
    exposeHeaders : 'Content-Range, X-Content-Range'
};
app.use(cors(corsOptions));

New Method

function configureExposeHeaders(options, req) {
  var headers = options.exposeHeaders;

  if (!headers) {
    return null;
  } else if (headers.join) {
    // .headers is an array, so turn it into a string
    headers = headers.join(',');
  }

  if (headers && headers.length) {
    return {
      key : 'Access-Control-Expose-Headers',
      value : headers
    };
  }
  return null;
}

Added it into the (req.method === 'OPTIONS')'s ELSE block.

(i.e. it fires every other time)

 headers.push(configureExposeHeaders(options, req));

[troygoode]

Fixed and pushed to npm as version 2.2.0.

Set the exposedHeaders property of the options passed into the cors middleware to use.