Expose diagnostic response fields to browser code deliberately

The useful distinctions

• Access-Control-Expose-Headers names additional response fields readable by script.
• Only safelisted response fields are exposed by default.
• The wildcard has special limitations for credentialed requests.

Separate seeing a response from reading its fields

Browser developer tools can display response metadata that a page's JavaScript cannot retrieve. For a cross-origin media inspection tool, that can make a present validator or range field appear absent when code asks for it. First establish whether response sharing is permitted, then examine which additional fields are exposed. These are two distinct checks, and changing one does not automatically settle the other.

Choose an exposure list for the actual task

The synthetic field exposes only Content-Range and ETag because the imagined tool needs an interval description and a representation identifier. It does not expose an open-ended set of internal diagnostics. A useful implementation review states why each field is needed and verifies that the field is actually present on the relevant responses. Exposure does not create missing metadata or validate its value. If a script still reads null, inspect spelling, response variation, sharing permission, and the observed request context before concluding the origin omitted the field. The example is a text-only policy illustration, with no browser or service execution implied. For the sample inspection workflow, keep network-visible fields and script-readable fields in separate columns. This makes it clear why a developer might see ETag in a trace while application code cannot read it.

Worked example · synthetic

The excerpt makes two non-safelisted diagnostic fields available to the named fictional origin. Reading them still depends on the complete cross-origin request and response context.

Synthetic text example; no network operation has been performed.

HTTP/MIME line endings are CRLF. Request URL context, where labelled, is commentary rather than a wire field. No message was transmitted.

Access-Control-Allow-Origin: https://inspector.example.invalid
Access-Control-Expose-Headers: Content-Range, ETag
Content-Range: bytes 100-199/1000
ETag: "sample-rev-2"

Check the interpretation

• Check that the response actually contains the named fields.
• Check sharing permission before exposure.
• Test credentialed contexts explicitly when applicable.