Cannot read response headers for CORS query using jQuery

Question

I have a working inter-segment web service call where I am returning my payload, but I cannot read the headers in the response. Chrome may show me the headers in the request perfectly, but they are not available in the jQuery handler.

var data_obj = { "userName": "myUser", "password": "000000" } $.ajax({ type: "POST", url: 'https://localhost:8443/AuthService.svc/auth', contentType: "application/json; charset=utf-8", data: JSON.stringify(data_obj), dataType: "json", success: function(data, textStatus, jqXHR) { console.log(jqXHR.getAllResponseHeaders()); } }); 

The only thing that registers on the console:

Content-Type: application / json; encoding = UTF-8

Here's what Chrome says for the OPTIONS and POST response headers, note that I'm trying to open Foo and Authorization through Acccess-Control-Expose-Headers :

Functions

 Acccess-Control-Expose-Headers:Content-Type, Foo, Authorization Access-Control-Allow-Headers:Content-Type, Foo, Authorization Access-Control-Allow-Methods:POST, PUT, DELETE Access-Control-Allow-Origin:* Access-Control-Max-Age:1728000 Content-Length:0 Date:Mon, 20 Jul 2015 16:26:00 GMT Foo:Bar 

Post

 Acccess-Control-Expose-Headers:Content-Type, Foo, Authorization Access-Control-Allow-Headers:Content-Type, Foo, Authorization Access-Control-Allow-Origin:* Authorization: custom_access_token = some_token Content-Length:36 Content-Type:application/json; charset=utf-8 Date:Mon, 20 Jul 2015 16:26:00 GMT Foo:Bar 

Can anyone understand why I can access the Content-Type header in my success callback?

Update

Note. I reorganized above to use XMLHttpRequest , the behavior is preserved.

Answer 1

There is a typo in the response header:

Accessory Control-Expose-Headers: Content-Type, Foo, Authorization

You have three "c" in the "access". I admit that too long has been noticed for me.

As long as I don't have Chrome (Firefox only), I replicated your request as close as I could, and a typo correction returned this:

Foo: Bar
Authorization: custom_access_token = some_token
Content-Type: text / html; encoding = UTF-8

Adding

When you see that in another answer you are invited to use withCredentials , if for some reason you did this, remember that Access-Control-Allow-Origin should match the Origin request header, which your browser is likely to install by itself, and it cannot be a wildcard. I am doing this here to avoid another problem.

The origin parameter specifies the URI that can access the resource. The browser must provide this. For queries without credentials, the server can specify "*" as a template, thereby allowing any source of access to the resource.

See Mozilla Docs