Reflection on Access-Control-Expose-Headers

[g6123]

It would be nice to support reflection on Access-Control-Expose-Headers header. For example, following configuration allows access to any response header whose name starts with X-Namespace-.

{
  // ...
  "exposedHeaders": /^X-Namespace-/i,
  // ...
}

Supported types may include: boolean value, string, comma-separated string, RegExp., function predicate, and array of all of them, some of which are already supported in the case of origin or allowedHeaders option.

[jub0bs]

@g6123 What about X-Namespace-foo response header that middleware add? At that stage, the CORS middleware has already finished executing and doesn't have an opportunity to further add to the Access-Control-Expose-Headers header.

The only reliable way to expose all response headers to (non-credentialed requests) to the client is to use the wildcard:

Access-Control-Expose-Headers: *