I am making a cross domain request in my web app.

I have set the CORS headers on Nginx. Everything is working fine except when the service returns an error like 404, 400, 500 etc, instead of receiving the error code, the service is failing with an error saying that the Origin *********** is not allowed by Access-Control-Allow-Origin.

Any ideas why this might be happening?

This is what the nginx setting looks like;

location /api {
    add_header Access-Control-Allow-Origin *;
  • I have set the CORS headers on Nginx. --> could you please show us?
    – quanta
    Sep 24, 2012 at 6:57
  • @quanta Edited the question...
    – Niyaz
    Sep 24, 2012 at 7:01

3 Answers 3


Unfortunately add_header won't work with status codes other than 200, 204, 301, 302 or 304. You can find this in the documentation here.

You may be able to use this plugin to do what you want:



You can use always directive starting nginx 1.7.5 (* Feature: the "always" parameter of the "add_header" directive.)

add_header 'Access-Control-Allow-Origin' '*' always;

I can confirm that the headers_more module (mentioned in this answer) can be used to add headers for all HTTP responses, regardless of status code.

Note: You may need the workaround at https://github.com/openresty/headers-more-nginx-module/issues/24 to build this module with Nginx on Windows, but it works as expected once compiled in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.