title: Access-Control-Expose-Headers does not work to allow JS client side to read cookies
body: <p>I make AJAX calls to CORS server, I make many attempts to be able to read cookies returned on response using javascript client side, however, in vain .</p>
  <h1>1. First Attempt :</h1>
  <h2>- Server Side (node.js powered by express) :</h2>
  <pre><code>  response.header('Access-Control-Allow-Origin', '*');
    response.header('Access-Control-Allow-Headers', 'X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, Set-Cookie');
    response.header('Access-Control-Expose-Headers', &quot;Set-Cookie&quot;);
  
   //------SET COOKIES
    response.cookie('SessionId', GeneratorId(64), {
              maxAge:3600000,
              httpOnly:flase // i disable httpOnly ==&gt; does not work
            });
  </code></pre>
  <h2>- client Side :</h2>
  <pre><code>var xhttp=new XMLHttpRequest();
  xhttp.open(&quot;POST&quot;, &quot;http://localhost:9090/api/map&quot;, true);
  xhttp,send(`{layer:1}`);
  </code></pre>
  <h1>2. Second Attempt: (withCredentials)</h1>
  <h2>-Server Side :</h2>
  <pre><code> //Append another response' header 
    response.header('Access-Control-Allow-Credentials','true'); 
  </code></pre>
  <h2>-Client Side :</h2>
  <pre><code>// Before xhttp.send , I add another instruction : 
   xhttp.withCredentials=true;
  </code></pre>
  <h1>3. Third Attempt :</h1>
  <h2>- Server Side :</h2>
  <pre><code>//Avoid the wildcard on Access-Control-Allow-Origin =&gt;Replace the first header by :
  response.header('Access-Control-Allow-Origin', request.get('Origin'));
  </code></pre>
  <h2>- Client Side :</h2>
  <pre><code> // Nothing is appended  
  </code></pre>
  <hr />
  <h1>Conclusion :</h1>
  <p>With all those attempts , <code>xhttp.getResponseHeader('Set-Cookie')</code> still returns <code>null</code> even :</p>
  <ul>
  <li><code>Set-Cookie</code> is assigned  to the response header : <code>Access-Control-Expose-Headers</code> .</li>
  <li>I saw cookies on the browser console (Inspector) :</li>
  </ul>
  <p><a href="https://i.stack.imgur.com/n74Bm.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/n74Bm.png" alt="enter image description here" /></a></p>