30

I am trying to send multiple headers

add_header Access-Control-Allow-Origin http://dev.anuary.com;
add_header Access-Control-Allow-Origin https://dev.anuary.com;

However, instead NGINX makes them into

Access-Control-Allow-Origin: http://dev.anuary.com, https://dev.anuary.com

What's the solution?

2 Answers 2

36

Well, yes, nginx is combining the identically named headers.. but it's doing so in accordance with the HTTP spec. See section 4.2.

The header:

Access-Control-Allow-Origin: http://dev.anuary.com, https://dev.anuary.com

Is, according to the HTTP/1.1 spec, functionally equivalent to:

Access-Control-Allow-Origin: http://dev.anuary.com
Access-Control-Allow-Origin: https://dev.anuary.com

If you have a system or application that is capable of reading one format and not the other, then it's the problem. nginx is doing it right.


EDIT:

The Mozilla documentation states that there can only be one Access-Control-Allow-Origin header.

The formatting of it (see here) should be a space-delimited list of origins:

add_header Access-Control-Allow-Origin "http://dev.anuary.com https://dev.anuary.com";

But really, you're supposed to be echoing the Origin header supplied by the client instead of generating one out of the blue. This is probably more appropriate:

if ($http_origin ~* "^https?://dev\.anuary\.com$" ) {
    add_header Access-Control-Allow-Origin $http_origin;
}
8
  • Well, the latter doesn't work in FireFox 9 or any other version. Which an issue.
    – Gajus
    Jan 16, 2012 at 16:24
  • 1
    @Guy Nor should it. See edit. Jan 16, 2012 at 16:59
  • NOTE: If the given solution doesn't work for you, read this and this. It's enlightening, and you may find the reason it isn't working.
    – its_me
    Feb 28, 2013 at 8:23
  • Can the value of Access-Control-Allow-Origin be regexp?
    – haxpanel
    Jun 14, 2016 at 11:37
  • 1
    Found it there: $http_origin ~* (example\.com$|localhost$) May 10, 2017 at 12:25
-3

I was facing the same issue as multiple sub domains in my network trying to access resources and nginx was not setup properly. Here is how I fixed it.

add_header Access-Control-Allow-Origin https://*.your-domain-name.com;

I hope this helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .