Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to send multiple headers

add_header Access-Control-Allow-Origin http://dev.anuary.com;
add_header Access-Control-Allow-Origin https://dev.anuary.com;

However, instead NGINX makes them into

Access-Control-Allow-Origin: http://dev.anuary.com, https://dev.anuary.com

What's the solution?

share|improve this question

1 Answer 1

up vote 7 down vote accepted

Well, yes, nginx is combining the identically named headers.. but it's doing so in accordance with the HTTP spec. See section 4.2.

The header:

Access-Control-Allow-Origin: http://dev.anuary.com, https://dev.anuary.com

Is, according to the HTTP/1.1 spec, functionally equivalent to:

Access-Control-Allow-Origin: http://dev.anuary.com
Access-Control-Allow-Origin: https://dev.anuary.com

If you have a system or application that is capable of reading one format and not the other, then it's the problem. nginx is doing it right.


EDIT:

The Mozilla documentation states that there can only be one Access-Control-Allow-Origin header.

The formatting of it (see here) should be a space-delimited list of origins:

add_header Access-Control-Allow-Origin "http://dev.anuary.com https://dev.anuary.com";

But really, you're supposed to be echoing the Origin header supplied by the client instead of generating one out of the blue. This is probably more appropriate:

if ($http_origin ~* "^https?://dev\.anuary\.com$" ) {
    add_header Access-Control-Allow-Origin $http_origin;
}
share|improve this answer
    
Well, the latter doesn't work in FireFox 9 or any other version. Which an issue. –  Guy Jan 16 '12 at 16:24
    
@Guy Nor should it. See edit. –  Shane Madden Jan 16 '12 at 16:59
    
NOTE: If the given solution doesn't work for you, read this and this. It's enlightening, and you may find the reason it isn't working. –  its_me Feb 28 '13 at 8:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.