Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With nginx can I specify Access-Control-Allow-Origin using a wildcard like *

Would it look like:

add_header Access-Control-Allow-Origin *;


share|improve this question
up vote 1 down vote accepted

You sure can. I use the following directive to support some of our cross domain fonts:

  add_header Access-Control-Allow-Origin *;
share|improve this answer
No I don't want wildcard for everything, but only I have a SaaS and each signup get's their own subdomain ( Also, I am testing and put add_header Access-Control-Allow-Origin; for testing, and assumed requests would fail, but surprisingly they still work. Any idea why? They should fail right? – Justin Feb 5 '13 at 20:13
Ah, I understand. Yes, you can use globs, though I can't say for certain why requests aren't failing like they should. The very long answer on how to use Access-Control is here: – Stephan Feb 5 '13 at 20:18
Actually further research, shows that Access-Control-Allow-Origin only supports * and a full host, i.e. wildcard domains are NOT supported. However still not sure why requests are working when I set: add_header Access-Control-Allow-Origin; – Justin Feb 5 '13 at 20:24
Ah, seems I learned something as well then! – Stephan Feb 5 '13 at 20:27
I posted my new problem if you wish to follow or provide further insight. Thanks.… – Justin Feb 5 '13 at 20:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.