I am getting a

XMLHttpRequest cannot load http://website2.com/ads/dev_642e92efb79421734881b53e1e1b18b6/5534f8e14d514_1.html. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://website1.com' is therefore not allowed access.

Website2 is configured using nginx:

server {
listen       80;
server_name  website2.com;
root  /var/www/website2;
index index.php index.html index.htm;
#try_files $uri $uri/ /index.php?$args;

client_max_body_size 20M;
location /ads {
    add_header 'Access-Control-Max-Age' 1728000;
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Credentials' 'true';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
  try_files $uri $uri/ /index.php?$args;
location / {
      try_files $uri $uri/ /index.php?$args;
     # proxy_pass;
     # proxy_set_header Host $host;
     # proxy_buffering off;

  gzip             on;
     gzip_vary        on;
     gzip_types       text/javascript text/css text/xml application/xml application/xml+rss;
     gzip_comp_level  9;
     gzip_min_length  100;
     gzip_buffers 16 8k;
     gzip_proxied     expired no-cache no-store private auth;
     gzip_http_version 1.0;
     gzip_disable     "MSIE [1-6]\.";
    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
        expires 24h;
        log_not_found off;
    location ~ \.php$ {
      try_files $uri =404;
      # Fix for server variables that behave differently under nginx/php-fpm than typically expected
      fastcgi_split_path_info ^(.+\.php)(/.+)$;
      # Include the standard fastcgi_params file included with nginx
      include fastcgi_params;
      fastcgi_param HTTPS $https;
      fastcgi_pass_header X_SECURECONNECTION;
      fastcgi_param  PATH_INFO        $fastcgi_path_info;
      fastcgi_index index.php;
      # Override the SCRIPT_FILENAME variable set by fastcgi_params
      fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
      # Pass to upstream PHP-FPM; This must match whatever you name your upstream connection
#preventing access to git
    location ~ /\.(?:git).* {
       deny all;
       access_log off;
       log_not_found off;
     #preventing access to .htaccess or htpasswd
     location ~ /\.ht.* {
     deny all;
     access_log off;
     log_not_found off;
    server_tokens off;
    if ($request_method !~ ^(GET|HEAD|POST)$ ) {
     return 444;
   location /images/ {
    valid_referers none blocked example.com *.example.com;
    if ($invalid_referer) {
      return   403;

How this webpage is getting requested is by: 1) Accessing a PHP file of website1. 2) The PHP file dies an html webpage which includes javascript files in website2. 3) Javascript uses ajax to get the html in website2 that is not allowed access, it uses the method GET.

The server address is still website1 when the process is over.

I also tried to add it to "location /".

Any ideas?


After following this: http://www.html5rocks.com/en/tutorials/cors/

The error was not shown given that add_header 'Access-Control-Allow-Origin' was added to server context, not a location context.

HOWEVER, it frequently does not work. A third or less of the requests still give back the same error:

XMLHttpRequest cannot load http://website2.com/ads/dev_642e92efb79421734881b53e1e1b18b6/5534f8e14d514_1.html. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://website1.com' is therefore not allowed access.

curl -I shows:

    HTTP/1.1 200 OK
Server: nginx
Date: Wed, 22 Apr 2015 10:30:55 GMT
Content-Type: text/html
Content-Length: 402
Last-Modified: Tue, 21 Apr 2015 09:13:44 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "553614c8-192"
Access-Control-Allow-Origin: *
Accept-Ranges: bytes

There are no proxied requests

Of this block:

location /ads {
    proxy_set_header 'Access-Control-Max-Age' 1728000;
    proxy_set_header 'Access-Control-Allow-Origin' '*';
    proxy_set_header 'Access-Control-Allow-Credentials' 'true';
    proxy_set_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    proxy_set_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
  try_files $uri $uri/ /index.php?$args;

The only directive that is doing anything is try_files - because there is no proxied request issued. proxy_pass_header only makes sense if proxy_pass is also used; but it would send the headers to the proxied server, not the client so is irrelevant for CORS.

Use add_header

The directive you're looking for is add_header - a valid example would be:

location /ads {
    add_header "Access-Control-Allow-Origin" "*";
    try_files $uri $uri/ /index.php?$args;

This adds the header to the response sent back to the client (browser).

| improve this answer | |
  • I'm sorry, I posted that configuration when I was testing. I actually have add_header instead of proxy_set_header. Please see the updated question. – zed Apr 21 '15 at 18:08
  • Question updated – zed Apr 22 '15 at 10:31
  • Deliberately or otherwise, you are not helping. The curl response (is it the response to the url in the code block directly above it? it's not clear) does not match the config in the question, also doesn't match the error message in the block above it. Please ensure the config in the question matches what you are using (e.g. - restart nginx if you haven't already done so) - show your full nginx config if you're removed some of it, and show the full response headers if you removed some of that too. – AD7six Apr 22 '15 at 10:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.