Mu current Nginx configuration is working fine with this url: https://myhostname.com

But I have created a different alias for same server, say myhostname1

Now when I try to access the url


it throws error

XMLHttpRequest cannot load https://sg-stg-bms-cdn001.eng.vmware.com//scripts/services/appStatusService.js?pingpong=2831234. The 'Access-Control-Allow-Origin' header has a value 'https://myhostname.com' that is not equal to the supplied origin. Origin 'https://myhostname1.com' is therefore not allowed access.

Both the host myhostname and myhostname1 is pointing to same IP and DNS entry.

I tried adding this line to my nginx configuration but that seems not working

   location / {
      add_header 'Access-Control-Allow-Origin' '*';

But still that doesn't seems to be working. Can anyone please help wher I am missing.

2 Answers 2


This link is probably more helpful than my summary but: either 'include (/path/to/sites-enabled)' at the end of your document and at that location have a config file detailing enabled sites, or, add blocks on a per-server basis (server{port; path; name; etc} you should already have one in the appropriate file for server{listen 80; server_name myhostname.com; index index.htm; root /path/to/root/folder}).


This message is telling you that your request violates javascript's same-origin security policy. If you're accessing the site with a browser, that message is probably coming from the browser, not from nginx. The same-origin policy in javascript security protects users from malicious websites attempting to use the browser's javascript to interact with other websites. Without this sandboxing, a malicious webpage could use the browser's javascript engine to interact with other websites -- perhaps change the user's email password, edit her facebook page, and so on.

You can selectively extend this security by adding http headers for cross-origin sharing (CORS). Nginx can do this for you. Here's how:

  1. If your config includes this directive, add_header X-XSS-Protection "1; mode=block";, remove it (or comment out). That removes a security provision that tells browsers to disallow CORS.
  2. Selectively extend cross-site scripting by adding CORS headers to requests. In the location block of each host, add these directives:
    add_header 'Access-Control-Allow-Origin' "$http_origin" always;
    add_header 'Access-Control-Allow-Credentials' 'true' always;
    add_header 'Access-Control-Allow-Methods' 'GET, POST' always;
    add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With' always;

Using "$http_origin" limits CORS to *.yourdomain.com, but you can also use 'Access-Control-Allow-Origin' '*' always, opening CORS to all sites -- a weaker security model. Newer versions of nginx require a third argument (always in this example). You're missing that in your config.

  • I tried adding add_header 'Access-Control-Allow-Origin' '*' always But it doesn't seems to be working.. not sure where I am missing
    – undefined
    Commented May 5, 2017 at 17:23
  • Did you do everything I listed in my answer or only that one directive? You need all of it. Commented May 5, 2017 at 18:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .