Unable to access Authorization header in Svelte – Nginx

I am new to Svelte, and am trying to create a login page to an API. The API takes a username and password and returns an Authorization header. I see the authorization header in the F12 developer console, and I am able to access other headers via code, but not the Authorization header. I have enabled CORS on the server for localhost:8080.

<script>
    const BASE_URL = ...;

    export let username;
    export let password;

    let result;
    let status;
    let body;
    let token;
    let contentType;

    async function doPost () {
        const res = await fetch(BASE_URL + 'authenticate', {
            method: 'POST',
            mode: 'cors',
            headers: { 'Content-Type': 'application/json' },
            body: JSON.stringify({
                'username': username,
                'password': password
            })
        });

        const text = await res.text();
        status = res.status;
        result = text;
        token = res.headers.get('Authorization');
        contentType = res.headers.get('Content-type');
        if (!res.ok) {
            throw new Error(result);
        }

    }

</script>
Please log in<br>
<input type="text" bind:value={username}/>
<br>
<input type="password" bind:value={password}/>
<br>
<button type="button" on:click={doPost}>Log in</button>
<br>
Result: {result}
<br>
Status: {status}
<br>
Token: {token}
<br>
Content-type: {contentType}

Response headers are as follows:

HTTP/1.1 200 
Server: nginx/1.20.0
Date: Tue, 31 May 2022 18:59:09 GMT
Content-Type: text/plain;charset=UTF-8
Content-Length: 8
Connection: keep-alive
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Access-Control-Allow-Origin: http://localhost:8080
Authorization: Bearer xyz...

The page displays as follows after logging in:

Result: Welcome!
Status: 200
Token: null
Content-type: text/plain;charset=UTF-8

Server side (spring boot) has the following annotation on the authenticate method:

@CrossOrigin(origins = "http://localhost:8080", allowedHeaders = "*", allowCredentials = "true")

As you can see, I am able to access the content-type header but not the authorization header. Any assistance would be greatly appreciated.