//后端放入response，默认前端无法访问
response.setHeader("**", token);

//将**暴露出来，前端即可拿到
response.setHeader("Access-Control-Expose-Headers", "**");