Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Nginx to serve static files in response to CORS requests using the technique outlined in this question. However, when the file doesn't exist the 404 response does not contain the Access-Control-Allow-Origin: * header and so is block by the browser.

How can I send Access-Control-Allow-Origin: * on 404 responses?

share|improve this question

Even though this was asked long ago, I was compiling nginx with more module, but with newer version of nginx, I found I don't have to custom compile nginx, all I needed was to add always directive.

Syntax: add_header name value [always];

If the always parameter is specified (1.7.5), the header field will be added regardless of the response code.

So a tuned version of CORS headers:

            if ($cors = "trueget") {
                    # Tells the browser this origin may make cross-origin requests
                    # (Here, we echo the requesting origin, which matched the whitelist.)
                    add_header 'Access-Control-Allow-Origin' "$http_origin" always;

                    # Tells the browser it may show the response, when XmlHttpRequest.withCredentials=true.
                    add_header 'Access-Control-Allow-Credentials' 'true' always;
share|improve this answer
always was the key. Thank you for pointing this me out, I was going mad! – bgondy 2 days ago

I'm assuming that you're currently using add_header directive. The documentation notes that this only sets the header for 200, 204, 301, 302 and 304 status code. To set the header for 404 status codes you'll need to use the more_set_headers directive from the headers_more module (you may need to recompile nginx to get this module). The following would set the header for all status codes:

more_set_headers 'Access-Control-Allow-Origin: *';

You can also restrict it to specific status codes:

more_set_headers -s '404' 'Access-Control-Allow-Origin: *';
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.