The solution is in an already related problem, but in a later comment: https://github.com/angular/angular/issues/5237#issuecomment-239174349
With the exception of some common headers, only headers listed as the value of the Access-Control-Expose-Headers header will be displayed in Angular2 (possibly with others). This should be added on the server side.
It took me over an hour to find out for the Authorization header. I thought this was not a custom header, but it is.
In PHP, call something like this: header("Access-Control-Expose-Headers: Authorization, X-Custom-header");
If you use Laravel as a backend with barryvdh/laravel-cors , do this in the config/cors.php .
source share