pub const CORS_EXPOSED_HEADERS: [HeaderName; 2];Expand description
The response headers a browser is allowed to show a script.
Anything not named here is stripped by the browser before the calling page sees it, and both of these carry the next step of a flow: the nonce a DPoP client must echo on its retry, and the challenge that says a token was refused and why.