'CORS: Browser not expsoing `location` header even though it's allowed in the `Access-Control-Allow-Headers`
I've been doing some work to configure CORS on my API server to restrict access. I'm currently serving the following headers for Access-Control-Allow-Headers from the options preflight.
access-control-allow-headers: location,x-correlation-id,content-range,authorization,accept,content-type,origin
Full OPTIONS preflight response:
However, when doing a POST where it returns a 201 response, the location header is not visible in my Axios response object in javascript. This appears to be caused by the browser rejecting the location header based on the CORS policy. I'm not sure what I'm missing that would allow the location header to pass-through to the browser.
POST Response
console.log of the response object in code.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|