diff --git a/server/internal/service/service.go b/server/internal/service/service.go
index 4344caa..ba01ec4 100644
--- a/server/internal/service/service.go
+++ b/server/internal/service/service.go
@@ -56,8 +56,8 @@ func Run(conn *pgx.Conn, q *data.Queries, config SvcConfig) error {
 	r.Use(cors.Handler(cors.Options{
 		AllowedOrigins:   config.allowedOrigins(),
 		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
-		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
-		ExposedHeaders:   []string{"List"},
+		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-Csrf-Token"},
+		ExposedHeaders:   []string{"List", "X-Csrf-Token"},
 		AllowCredentials: true,
 		MaxAge:           300,
 	}))