From the https://stackoverflow.com/a/54928828/13963150:
Headers are limited for CORS requests. See https://stackoverflow.com/a/44816592/2047472
(Use access-control-expose-headers to allow exposing headers to requests from a different origin.)
To expose a header using the CORS plugin, you can use the exposeHeader method.