diff --git a/src/Config.hs b/src/Config.hs
index ea628b5a8..fae4d5490 100644
--- a/src/Config.hs
+++ b/src/Config.hs
@@ -47,7 +47,7 @@ corsPolicy req = case lookup "origin" headers of
     , corsRequestHeaders = "Authentication":accHeaders
     , corsExposedHeaders = Just [
           "Content-Encoding", "Content-Location", "Content-Range", "Content-Type"
-        , "Date", "Server", "Transfer-Encoding", "Range-Unit"
+        , "Date", "Location", "Server", "Transfer-Encoding", "Range-Unit"
         ]
     }
   Nothing -> Nothing
diff --git a/test/Feature/CorsSpec.hs b/test/Feature/CorsSpec.hs
index 1ba3c51a0..2e108e8f3 100644
--- a/test/Feature/CorsSpec.hs
+++ b/test/Feature/CorsSpec.hs
@@ -59,7 +59,7 @@ spec = around withApp $ describe "CORS" $ do
         liftIO $ simpleHeaders r `shouldSatisfy` matchHeader
           "Access-Control-Expose-Headers"
           "Content-Encoding, Content-Location, Content-Range, Content-Type, \
-            \Date, Server, Transfer-Encoding, Range-Unit"
+            \Date, Location, Server, Transfer-Encoding, Range-Unit"
 
     describe "postflight request" $
       it "allows INFO body through even with CORS request headers present" $ do