Your browser restricts your frontend JavaScript code to only being able to access the Cache-Control
, Content-Language
, Content-Type
, Expires
, Last-Modified
, and Pragma
response headers, unless the response has an Access-Control-Expose-Headers
response header that lists other header names that the browser should also expose.
see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers
In the case of the response shown in the question, the Access-Control-Expose-Headers: Date
response header tells the browser to also expose the Date
header. Therefore your code is able to get that header. But that Access-Control-Expose-Headers
header doesn’t list the Server
, Accept-Ranges
, or Content-Length
header names. So your code isn’t able to get those.
And again, your browser is what’s preventing your code from getting at those. The browser itself gets all the response headers, and that’s why you can see them in browser devtools. But just because you can see them there don’t mean the browser will expose them to your code; the browser will only expose what the Access-Control-Expose-Headers
header tells it to expose.