Access-Control-Expose-Headers does not work to allow JS client side to read cookies

Question

I make AJAX calls to CORS server, I make many attempts to be able to read cookies returned on response using javascript client side, however, in vain .

1. First Attempt :

- Server Side (node.js powered by express) :

  response.header('Access-Control-Allow-Origin', '*');
  response.header('Access-Control-Allow-Headers', 'X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, Set-Cookie');
  response.header('Access-Control-Expose-Headers', "Set-Cookie");

 //------SET COOKIES
  response.cookie('SessionId', GeneratorId(64), {
            maxAge:3600000,
            httpOnly:flase // i disable httpOnly ==> does not work
          });

- client Side :

var xhttp=new XMLHttpRequest();
xhttp.open("POST", "http://localhost:9090/api/map", true);
xhttp,send(`{layer:1}`);

2. Second Attempt: (withCredentials)

-Server Side :

 //Append another response' header 
  response.header('Access-Control-Allow-Credentials','true'); 

-Client Side :

// Before xhttp.send , I add another instruction : 
 xhttp.withCredentials=true;

3. Third Attempt :

- Server Side :

//Avoid the wildcard on Access-Control-Allow-Origin =>Replace the first header by :
response.header('Access-Control-Allow-Origin', request.get('Origin'));

- Client Side :

 // Nothing is appended  

---

Conclusion :

With all those attempts , xhttp.getResponseHeader('Set-Cookie') still returns null even :

• Set-Cookie is assigned to the response header : Access-Control-Expose-Headers .
• I saw cookies on the browser console (Inspector) :

Answer 1

TL;DR: the Set-Cookie header is entirely off-limits: you can't access it, even when you include it in Access-Control-Expose-Headers. However, once it's set, and the cookie isn't marked httpOnly, you should be able to access it through document.cookie.

TMI follows:

As documented here,

A response will typically get its CORS-exposed header-name list set by parsing the Access-Control-Expose-Headers header. This list is used by a CORS filtered response to determine which headers to expose.

What a CORS filtered response is, is documented here:

A CORS filtered response is a filtered response whose type is "cors", header list excludes any headers in internal response's header list whose name is not a CORS-safelisted response-header name, given internal response's CORS-exposed header-name list, and trailer is empty.

And safelisted headers are subsequently documented here:

• Cache-Control
• Content-Language
• Content-Type
• Expires
• Last-Modified
• Pragma

Any value in list that is not a forbidden response-header name.

Finally, the list of forbidden response-header names is listed here:

• Set-Cookie
• Set-Cookie2