FrontendHaltBrowser internals·Intermediate·Conceptual·1 min read
What is a CORS-safelisted response header?
Short interview answer
It is one of a small set of headers, such as Content-Type within certain values, that JavaScript can read from a cross-origin response without the server needing to list it in Access-Control-Expose-Headers.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.