Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to send multiple headers

add_header Access-Control-Allow-Origin;
add_header Access-Control-Allow-Origin;

However, instead NGINX makes them into


What's the solution?

share|improve this question
up vote 11 down vote accepted

Well, yes, nginx is combining the identically named headers.. but it's doing so in accordance with the HTTP spec. See section 4.2.

The header:


Is, according to the HTTP/1.1 spec, functionally equivalent to:


If you have a system or application that is capable of reading one format and not the other, then it's the problem. nginx is doing it right.


The Mozilla documentation states that there can only be one Access-Control-Allow-Origin header.

The formatting of it (see here) should be a space-delimited list of origins:

add_header Access-Control-Allow-Origin "";

But really, you're supposed to be echoing the Origin header supplied by the client instead of generating one out of the blue. This is probably more appropriate:

if ($http_origin ~* "^https?://dev\.anuary\.com$" ) {
    add_header Access-Control-Allow-Origin $http_origin;
share|improve this answer
Well, the latter doesn't work in FireFox 9 or any other version. Which an issue. – Gajus Jan 16 '12 at 16:24
@Guy Nor should it. See edit. – Shane Madden Jan 16 '12 at 16:59
NOTE: If the given solution doesn't work for you, read this and this. It's enlightening, and you may find the reason it isn't working. – its_me Feb 28 '13 at 8:23
Can the value of Access-Control-Allow-Origin be regexp? – haxpanel Jun 14 at 11:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.