diff --git a/src/Config.hs b/src/Config.hs
index 84b1c6f78..ea628b5a8 100644
--- a/src/Config.hs
+++ b/src/Config.hs
@@ -45,6 +45,10 @@ corsPolicy req = case lookup "origin" headers of
   Just origin -> Just defaultCorsPolicy {
       corsOrigins = Just ([origin], True)
     , corsRequestHeaders = "Authentication":accHeaders
+    , corsExposedHeaders = Just [
+          "Content-Encoding", "Content-Location", "Content-Range", "Content-Type"
+        , "Date", "Server", "Transfer-Encoding", "Range-Unit"
+        ]
     }
   Nothing -> Nothing
   where
diff --git a/test/Feature/CorsSpec.hs b/test/Feature/CorsSpec.hs
index 353886926..1ba3c51a0 100644
--- a/test/Feature/CorsSpec.hs
+++ b/test/Feature/CorsSpec.hs
@@ -53,6 +53,14 @@ spec = around withApp $ describe "CORS" $ do
         r <- request methodOptions "/" preflightHeaders ""
         liftIO $ simpleBody r `shouldBe` ""
 
+    describe "regular request" $
+      it "exposes necesssary response headers" $ do
+        r <- request methodGet "/items" [("Origin", "http://example.com")] ""
+        liftIO $ simpleHeaders r `shouldSatisfy` matchHeader
+          "Access-Control-Expose-Headers"
+          "Content-Encoding, Content-Location, Content-Range, Content-Type, \
+            \Date, Server, Transfer-Encoding, Range-Unit"
+
     describe "postflight request" $
       it "allows INFO body through even with CORS request headers present" $ do
         r <- request methodOptions "/items" normalCors ""