What is an Access-Control-Expose-Headers header?

Lists which response headers a cross-origin script is allowed to access, beyond the small CORS-safelisted set.