diff --git a/PiBox.Hosting/WebHost/src/PiBox.Hosting.WebHost/Extensions/CorsPolicyExtensions.cs b/PiBox.Hosting/WebHost/src/PiBox.Hosting.WebHost/Extensions/CorsPolicyExtensions.cs
index 55e5089..4967342 100644
--- a/PiBox.Hosting/WebHost/src/PiBox.Hosting.WebHost/Extensions/CorsPolicyExtensions.cs
+++ b/PiBox.Hosting/WebHost/src/PiBox.Hosting.WebHost/Extensions/CorsPolicyExtensions.cs
@@ -12,6 +12,8 @@ public static void SetSanityDefaults(this CorsPolicy corsPolicy)
                 corsPolicy.Methods.Add("*");
             if (!corsPolicy.Origins.Any())
                 corsPolicy.Origins.Add("*");
+            if (!corsPolicy.ExposedHeaders.Any())
+                corsPolicy.ExposedHeaders.Add("*");
         }
     }
 }
diff --git a/PiBox.Hosting/WebHost/test/PiBox.Hosting.WebHost.Tests/CorsPolicyExtensionTests.cs b/PiBox.Hosting/WebHost/test/PiBox.Hosting.WebHost.Tests/CorsPolicyExtensionTests.cs
index ea132cd..00b00d1 100644
--- a/PiBox.Hosting/WebHost/test/PiBox.Hosting.WebHost.Tests/CorsPolicyExtensionTests.cs
+++ b/PiBox.Hosting/WebHost/test/PiBox.Hosting.WebHost.Tests/CorsPolicyExtensionTests.cs
@@ -10,18 +10,21 @@ public class CorsPolicyExtensionTests
         [Test]
         public void SetSanityDefaults()
         {
-            CorsPolicy corsPolicy = new CorsPolicy();
+            var corsPolicy = new CorsPolicy();
             corsPolicy.Origins.Any().Should().BeFalse();
             corsPolicy.AllowAnyOrigin.Should().BeFalse();
             corsPolicy.Headers.Any().Should().BeFalse();
             corsPolicy.AllowAnyHeader.Should().BeFalse();
             corsPolicy.Methods.Any().Should().BeFalse();
             corsPolicy.AllowAnyMethod.Should().BeFalse();
+            corsPolicy.ExposedHeaders.Should().HaveCount(0);
 
             corsPolicy.SetSanityDefaults();
             corsPolicy.AllowAnyOrigin.Should().BeTrue();
             corsPolicy.AllowAnyHeader.Should().BeTrue();
             corsPolicy.AllowAnyMethod.Should().BeTrue();
+            corsPolicy.ExposedHeaders.Should().HaveCount(1);
+            corsPolicy.ExposedHeaders.Should().Contain("*");
         }
     }
 }