Client-side javascript: how can I get the response header of a HTTP request when CORS is not allowed?

Question

In the browser, I'm doing an HTTP request. The resource at reqUrl doesn't enable CORS, so there's no response body. But how can I get the response header? (I can see it in the DevTools' network tab.)

var p = fetch(reqUrl, { method: "POST", headers: reqHeader, body: reqBody }); p.then(function () { }) .catch(function (err) { // CORS is disabled so I'm arriving here // "TypeError: NetworkError when attempting to fetch resource." });

dandavis · Accepted Answer · 2017-06-09 13:47:01Z

You can't, unless it supports CORS and has the header name white-listed. This is a security matter since getting forbidden header content is as risky as forbidden response content. The dev tools feature is not restricted by the SOP, so it doesn't need such "perms" to show the user debug information. You cannot reach any devtool info by scripts, so it's safe just to show to the user.

Collectives™ on Stack Overflow

Client-side javascript: how can I get the response header of a HTTP request when CORS is not allowed?

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related