Access-Control-Expose-Headers does not work to allow JS client side to read cookies
<p>I make AJAX calls to CORS server, I make many attempts to be able to read cookies returned on response using javascript client side, however, in vain .</p>
<h1>1. First Attempt :</h1>
<h2>- Server Side (node.js powered by express) :</h2>
<pre><code>  response.header('Access-Control-Allow-Origin', '*');
  response.header('Access-Control-Allow-Headers', 'X-Requested-With, X-HTTP-Method-Override, Content-Type, Accept, Set-Cookie');
  response.header('Access-Control-Expose-Headers', &quot;Set-Cookie&quot;);

 //------SET COOKIES
  response.cookie('SessionId', GeneratorId(64), {
            maxAge:3600000,
            httpOnly:flase // i disable httpOnly ==&gt; does not work
          });
</code></pre>
<h2>- client Side :</h2>
<pre><code>var xhttp=new XMLHttpRequest();
xhttp.open(&quot;POST&quot;, &quot;http://localhost:9090/api/map&quot;, true);
xhttp,send(`{layer:1}`);
</code></pre>
<h1>2. Second Attempt: (withCredentials)</h1>
<h2>-Server Side :</h2>
<pre><code> //Append another response' header 
  response.header('Access-Control-Allow-Credentials','true'); 
</code></pre>
<h2>-Client Side :</h2>
<pre><code>// Before xhttp.send , I add another instruction : 
 xhttp.withCredentials=true;
</code></pre>
<h1>3. Third Attempt :</h1>
<h2>- Server Side :</h2>
<pre><code>//Avoid the wildcard on Access-Control-Allow-Origin =&gt;Replace the first header by :
response.header('Access-Control-Allow-Origin', request.get('Origin'));
</code></pre>
<h2>- Client Side :</h2>
<pre><code> // Nothing is appended  
</code></pre>
<hr />
<h1>Conclusion :</h1>
<p>With all those attempts , <code>xhttp.getResponseHeader('Set-Cookie')</code> still returns <code>null</code> even :</p>
<ul>
<li><code>Set-Cookie</code> is assigned  to the response header : <code>Access-Control-Expose-Headers</code> .</li>
<li>I saw cookies on the browser console (Inspector) :</li>
</ul>
<p><a href="https://i.stack.imgur.com/n74Bm.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/n74Bm.png" alt="enter image description here" /></a></p>