diff --git a/src/main/java/auth_service/configuration/security/SecurityConfig.java b/src/main/java/auth_service/configuration/security/SecurityConfig.java
index b7f92df..120c75e 100644
--- a/src/main/java/auth_service/configuration/security/SecurityConfig.java
+++ b/src/main/java/auth_service/configuration/security/SecurityConfig.java
@@ -68,6 +68,8 @@ public class SecurityConfig {
         configuration.setAllowedOriginPatterns(Arrays.asList(allowedOrigins));
         configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
         configuration.setAllowedHeaders(List.of("*"));
+        // Lets the login page read how long a rate-limit block lasts
+        configuration.setExposedHeaders(List.of("Retry-After"));
         configuration.setAllowCredentials(false); // Set to true later if we use cookies
 
         UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();