XMLHttpRequest response doesn't return Authorization header - xmlhttprequest

Question

I'm trying to get authorization token from server by using XMLHttpRequest, but only some headers are returned (without Authorization header).
Server is working on localhost:8080 but client application is on localhost:3000 so I tried to configure CORS.
On server site I created a CorsConfigurationSource bean:
#Bean
CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration();
configuration.applyPermitDefaultValues();
configuration.setAllowedOrigins(Arrays.asList("http://localhost:3000"));
configuration.setAllowedMethods(Arrays.asList("GET","POST","DELETE","PUT"));
configuration.setAllowCredentials(true);
configuration.setAllowedHeaders(Arrays.asList("Authorization, X-Content-Type-Options, " +
"X-XSS-Protection, Cache-Control, Pragma, Expires, X-Frame-Options, Content-Length, Date"));
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
and on client site I use XMLHttpRequest:
var httpRequest = new XMLHttpRequest();
httpRequest.open("POST", "http://localhost:8080/login", true);
httpRequest.setRequestHeader(
"Content-Type",
"application/json;charset=UTF-8"
);
httpRequest.setRequestHeader(
"Access-Control-Expose-Headers",
"Authorization"
);
httpRequest.onreadystatechange = function () {
console.log("RESPONSE HEADER : " + httpRequest.getAllResponseHeaders());
};
httpRequest.withCredentials = true;
httpRequest.send(userBody);
When I try to get all headers I only get some of them (like cache-control, content-length, expires, pragma) without Authorization header and other headers. What should I change to get all of them? Thank You for any help.
enter image description here

Answer 1

I managed to solve this by setting exposed headers on server site:
configuration.setExposedHeaders(Arrays.asList("Authorization, X-Content-Type-Options, " +
"X-XSS-Protection, Cache-Control, Pragma, Expires, X-Frame-Options, Content-Length, Date"));