When doing a CORS request using either fetch or XMLHttpRequest, some headers are missing from the response.

To be precise, those APIs drop all headers, that are not explicitely “whitelisted” by the server for cross-origin requests (using Access-Control-Expose-Headers). That I know.

However, if those headers should only be visible when the request is not cross-origin, why does the server send those headers anyway?

What I mean is, most headers are not visible to fetch and xhr, but they are visible to the browser – as evident when having a look at the network tab. It clearly shows all the headers I’d expect in the response, even those not available via the programmatic calls.

Since the headers exist and are sent by the server, couldn’t there be a way to still read those headers programmatically? Why is there this restriction between what the browser sees and what it hands to the APIs?