I am using Debian 7 and Nginx 1.2.1. Http headers module is enabled by default with Debian packets (https://wiki.debian.org/Nginx). I am trying to add links to facebook, twitter and google plus accounts using their given links (with images hosted on their side). Problem is that my browser does not display these 3 images. I were using Apache before and had the module and instruction Header set Access-Control-Allow-Origin "*" in my site config.

I moved to Nginx and cannot manage to get the equivalent working with the following configuration. I also have Naxsi enabled, using a set of generic rules for wordpress.

No error logs, no idea where to inspect to find the beginning of an answer. All that I found on the internet are these similar questions with similar answers, unfortunately for me (e.g. How do I add Access-Control-Allow-Origin in NGINX?).

server {
 server_name blog.example.com;

 root /blog/example;
 index index.php;

 location / {
   try_files $uri $uri/ /index.php?q=$uri&$args; 

   add_header 'Access-Control-Allow-Origin' '*';
location ~ \.php$ {
  try_files $uri =404;
  fastcgi_pass unix:/var/run/php5-fpm.sock;
  fastcgi_index index.php;
  include fastcgi_params;

if ($request_method !~ ^(GET|POST|HEAD)$ ) {
  return 444;

# location ~* \.(ttf|ttc|otf|eot|woff)$ {
#   add_header 'Access-Control-Allow-Origin' '*';
# }

Also, curl -I blog.example.com displays (missing the header directive for cross-origin ?)

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 28 May 2015 06:59:26 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Powered-By: PHP/5.4.39-0+deb7u2
X-Pingback: http://blog.example.com/abc

I need to recompile Nginx in order to add some other modules and was wondering if headers more could help (https://github.com/openresty/headers-more-nginx-module), though http headers module should be enough apparently.

Thanks for your support.


Just realised I was completely wrong and actually did not get it. It is about loading fonts from another domain. In my browser console, I can see I am loading the fonts from another domain (that are not displayed in my browser). No error, I get http code 200, and yet 0KB downloaded (so nothing to be displayed) and when I open the file in a new tab, I can download the content (so it is actually available).

  • You are using an ancient version of nginx. I am trying to add links to facebook, twitter and google plus accounts using their given links (with images hosted on their side) This has nothing to do with Access-Control-Allow-Origin on your site, please demonstrate a problem - it doesn't look like what you think it is (and also sounds off topic). Also, fwiw, putting things in the / location block will have no effect if it's not the location block handling the request (which is the case, since it's handled by the php location block). – AD7six May 28 '15 at 7:55
  • Thanks for the reply. I tried adding add_header 'Access-Control-Allow-Origin' '*'; everywhere I could but it didn't help (although your comment is quite true !). I do not have access to the website files, I am just required to set nginx so that "it works" : the last person that had setup this had apache and the same problem occurred, which was solved, apparently , by using Header set Access-Control-Allow-Origin "*" in apache sites-available conf. The equivalent in nginx appears to be what I am trying to set up but does not change anything. – Bamse May 28 '15 at 8:12
  • Please re-read my first comment =) please demonstrate a problem. The absence of the header is not a problem, the js/whatever error related to my browser does not display these 3 image is the problem - what images, and what error? check your browser console. – AD7six May 28 '15 at 8:22
  • I realised some stuff and edited my original post. It probably changes a bit what I was first describing... hopefully makes it clearer ! – Bamse May 28 '15 at 8:43

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.