客户端javascript：不允许使用CORS时，如何获取HTTP请求的响应标头？

Question

In the browser, I'm doing an HTTP request. The resource at reqUrl doesn't enable CORS, so there's no response body. But how can I get the response header? (I can see it in the DevTools' network tab.)

var p = fetch(reqUrl, {
  method: "POST",
  headers: reqHeader,
  body: reqBody
});

p.then(function () {
})
.catch(function (err) {
   // CORS is disabled so I'm arriving here
   // "TypeError: NetworkError when attempting to fetch resource."
});

Answer 1

You can't, unless it supports CORS and has the header name white-listed. This is a security matter since getting forbidden header content is as risky as forbidden response content. The dev tools feature is not restricted by the SOP, so it doesn't need such "perms" to show the user debug information. You cannot reach any devtool info by scripts, so it's safe just to show to the user.