Repository: quarkusio/quarkus
Issue: Access-Control-Expose-Headers not returned to request

### Describe the bug

The Access-Control-Expose-Headers is only returned during the preflight request but not included in the subsequent request itself. Consequently, the header cannot be accessed through JavaScript in the browser.

### Expected behavior

The Access-Control-Expose-Headers should be returned

### Actual behavior

The Access-Control-Expose-Headers  is not returned.

### How to Reproduce?

1 - Configure the quarkus.http.cors.exposed-headers with some header.
2 - Send a request from browser

### Output of `uname -a` or `ver`

_No response_

### Output of `java -version`

_No response_

### GraalVM version (if different from Java)

_No response_

### Quarkus version or git rev

_No response_

### Build tool (ie. output of `mvnw --version` or `gradlew --version`)

_No response_

### Additional information

_No response_

Changed files:
extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/cors/CORSFilter.java
extensions/reactive-routes/deployment/src/test/java/io/quarkus/vertx/web/cors/CORSFullConfigHandlerTestCase.java

diff --git a/extensions/reactive-routes/deployment/src/test/java/io/quarkus/vertx/web/cors/CORSFullConfigHandlerTestCase.java b/extensions/reactive-routes/deployment/src/test/java/io/quarkus/vertx/web/cors/CORSFullConfigHandlerTestCase.java
index 445fe9adc05..8b829208564 100644
--- a/extensions/reactive-routes/deployment/src/test/java/io/quarkus/vertx/web/cors/CORSFullConfigHandlerTestCase.java
+++ b/extensions/reactive-routes/deployment/src/test/java/io/quarkus/vertx/web/cors/CORSFullConfigHandlerTestCase.java
@@ -32,6 +32,15 @@ public void corsFullConfigTestServlet() {
                 .header("Access-Control-Allow-Headers", "X-Custom")
                 .header("Access-Control-Max-Age", "86400");
 
+        given().header("Origin", "http://custom.origin.quarkus")
+                .when()
+                .get("/test").then()
+                .statusCode(200)
+                .header("Access-Control-Allow-Origin", "http://custom.origin.quarkus")
+                .header("Access-Control-Allow-Methods", "GET,PUT,POST")
+                .header("Access-Control-Expose-Headers", "Content-Disposition")
+                .header("Access-Control-Allow-Headers", "X-Custom");
+
         given().header("Origin", "http://www.quarkus.io")
                 .header("Access-Control-Request-Method", "PUT")
                 .when()
@@ -40,6 +49,7 @@ public void corsFullConfigTestServlet() {
                 .header("Access-Control-Allow-Origin", "http://www.quarkus.io")
                 .header("Access-Control-Allow-Methods", "GET,PUT,POST")
                 .header("Access-Control-Expose-Headers", "Content-Disposition");
+
     }
 
     @Test
diff --git a/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/cors/CORSFilter.java b/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/cors/CORSFilter.java
index 4cd477c951b..4304433190d 100644
--- a/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/cors/CORSFilter.java
+++ b/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/cors/CORSFilter.java
@@ -176,6 +176,12 @@ public void handle(RoutingContext event) {
             if (allowedMethods != null) {
                 response.headers().add(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, allowedMethods);
             }
+
+            //always set expose headers if present
+            if (exposedHeaders != null) {
+                response.headers().add(HttpHeaders.ACCESS_CONTROL_EXPOSE_HEADERS, exposedHeaders);
+            }
+
             //we check that the actual request matches the allowed methods and headers
             if (!isMethodAllowed(request.method())) {
                 LOG.debug("Method is not allowed");
@@ -216,10 +222,6 @@ private void handlePreflightRequest(RoutingContext event, String requestedHeader
             response.headers().add(HttpHeaders.ACCESS_CONTROL_EXPOSE_HEADERS, exposedHeaders);
         }
 
-        if (!isConfiguredWithWildcard(corsConfig.exposedHeaders)) {
-            response.headers().set(HttpHeaders.ACCESS_CONTROL_EXPOSE_HEADERS, this.exposedHeaders);
-        }
-
     }
 
     static boolean isSameOrigin(HttpServerRequest request, String origin) {