Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

How do I set the Access-Control-Allow-Origin header so I can use web-fonts from my subdomain on my main domain?


Notes:

You'll find examples of this and other headers for most HTTP servers in the HTML5BP Server Configs projects https://github.com/h5bp/server-configs

share|improve this question
1  
ah finally found the answer location / { add_header Access-Control-Allow-Origin "*"; } –  Chris McKee Jul 20 '10 at 22:59

2 Answers 2

up vote 71 down vote accepted

Nginx has to be compiled with http://wiki.nginx.org/NginxHttpHeadersModule. Then you can do this

location ~* \.(eot|ttf|woff)$ {
    add_header Access-Control-Allow-Origin *;
}
share|improve this answer
    
Follow this instructions in case you want want to implement the same solution on apache: stackoverflow.com/questions/11616306/… –  camilo_u Feb 5 '13 at 16:46
    
This link helped me out: gist.github.com/michiel/1064640 –  meawoppl Sep 17 '13 at 2:35
2  
That module seems to be compiled by default (at least on Ubuntu). –  Steve Bennett Sep 8 '14 at 13:25
    
also compiled by default on amazon linux repo –  Ross yesterday

A more up-to-date answer:

#
# Wide-open CORS config for nginx
#
location / {
     if ($request_method = 'OPTIONS') {
        add_header 'Access-Control-Allow-Origin' '*';
        #
        # Om nom nom cookies
        #
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        #
        # Custom headers and headers various browsers *should* be OK with but aren't
        #
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
        #
        # Tell client that this pre-flight info is valid for 20 days
        #
        add_header 'Access-Control-Max-Age' 1728000;
        add_header 'Content-Type' 'text/plain charset=UTF-8';
        add_header 'Content-Length' 0;
        return 204;
     }
     if ($request_method = 'POST') {
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
     }
     if ($request_method = 'GET') {
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
     }
}

source: https://michielkalkman.com/snippets/nginx-cors-open-configuration.html

Configs for other web servers http://enable-cors.org/server.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.