I am trying to send multiple headers

add_header Access-Control-Allow-Origin http://dev.anuary.com;
add_header Access-Control-Allow-Origin https://dev.anuary.com;

However, instead NGINX makes them into

Access-Control-Allow-Origin: http://dev.anuary.com, https://dev.anuary.com

What's the solution?


Well, yes, nginx is combining the identically named headers.. but it's doing so in accordance with the HTTP spec. See section 4.2.

The header:

Access-Control-Allow-Origin: http://dev.anuary.com, https://dev.anuary.com

Is, according to the HTTP/1.1 spec, functionally equivalent to:

Access-Control-Allow-Origin: http://dev.anuary.com
Access-Control-Allow-Origin: https://dev.anuary.com

If you have a system or application that is capable of reading one format and not the other, then it's the problem. nginx is doing it right.


The Mozilla documentation states that there can only be one Access-Control-Allow-Origin header.

The formatting of it (see here) should be a space-delimited list of origins:

add_header Access-Control-Allow-Origin "http://dev.anuary.com https://dev.anuary.com";

But really, you're supposed to be echoing the Origin header supplied by the client instead of generating one out of the blue. This is probably more appropriate:

if ($http_origin ~* "^https?://dev\.anuary\.com$" ) {
    add_header Access-Control-Allow-Origin $http_origin;
  • Well, the latter doesn't work in FireFox 9 or any other version. Which an issue. – Gajus Jan 16 '12 at 16:24
  • 1
    @Guy Nor should it. See edit. – Shane Madden Jan 16 '12 at 16:59
  • NOTE: If the given solution doesn't work for you, read this and this. It's enlightening, and you may find the reason it isn't working. – its_me Feb 28 '13 at 8:23
  • Can the value of Access-Control-Allow-Origin be regexp? – haxpanel Jun 14 '16 at 11:37
  • Would you mind extending your example to multiple origins (Eg. http://example.com and http://localhost:3000)? – Augustin Riedinger May 10 '17 at 12:21

Check out this post for configuring your nginx CORS with dynamic domains: https://qa.lsproc.com/post/access-control-allow-origin-multiple-origin-domains


I was facing the same issue as multiple sub domains in my network trying to access resources and nginx was not setup properly. Here is how I fixed it.

add_header Access-Control-Allow-Origin https://*.your-domain-name.com;

I hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.