Cordova app doesn't have access to HTTP response headers

Question

I'm migrating a React 16 app to Apache Cordova (v10.0). I'm using the axios HTTP library.

When I run the original version, I my app has access to authentication response headers with a bearer token (etc) in the response object. But when I run the same app and make the same request from Cordova, I can't get the authentication tokens. The when I console.log the response object, the Cordova version only receives two headers: cache-control and content-type.

import axios from 'axios';

const myApi = axios.create({
    withCredentials: false,
    headers: {
        'Accept': 'application/json',
        'Cache-Control': 'no-cache'
    }
});

    myApi.post(authenticationPath, {
      email: 'foo@example.com',
      password: 'bar'
    })
    .then( response => {
      console.log(response);
      // In the original version, response.headers has auth token, etc
      // In the Cordova version, response.headers only has cache-control + content-type
    })

Update: I checked the raw HTTP response in the dev tools and the missing headers are there. So it appears that my backend API is responding correctly, but for some reason javascript can't see them in the response object (in the Cordova version of my app)

Answer 1

I found the solution to my issue here: Axios get access to response header fields

TLDR = For CORS responses, the browser can only see a couple "safe" headers. To see the rest, the server needs to explicitly whitelist them with additional headers.