You're looking for a response header of Set-Cookie
:
xhr.getResponseHeader('Set-Cookie');
It won't work with HTTPOnly cookies though.
According to the XMLHttpRequest Level 1 and XMLHttpRequest Level 2, this particular response headers falls under the "forbidden" response headers that you can obtain using getResponseHeader()
, so the only reason why this could work is basically a "naughty" browser.