I have a couple of unforeseeable domain referrers which I want to allow get resources from my servers and also allowing to set credentials.

I know that this is kind of stupit to work against the security features of W3C but I can't add all domains every time a new domans wants to do a request for a ressource.

So what i have so far is a location block where I add a header like this:

add_header 'Access-Control-Allow-Origin' $http_referer;

This works great. Almost. When the request does request the Nginx the referrer is always showing up with tailing slash. Which in fact isn't the truth and the domain can't grab the resource. Example looks like this. in url is: http://example.com nginx shows that $http_referer is http://example.com/ so resource is not allowed to access because http://example.com is not http://example.com/

How can I replace the referrer the right way and omit the tailing slash where there is no...? There are also probably more complex referrers with path etc...


One solution is to use the nginx map feature. In the HTTP level, you define the map:

map $http_referer $alloworigin {
    ^(.+)/$ $1;
    ^(.+)[^/]$ $1;
    default "";

And then for add_header you use the following:

add_header 'Access-Control-Allow-Origin' $alloworigin;

Here the map transforms $http_referer to $alloworigin variable as follows:

  1. If $http_referer contains at least one character and ends with /, the / is removed.
  2. If $http_referer contains at least one character and does not end with /, the whole string is copied.
  3. If there is no $http_referer or it is empty, $alloworigin is empty.

The numbers above correspond to the map lines.

  • thanx for the snippet. I can't get this working: I put your snippet into nginx.conf and include the server conf.d. On server level i put server{ listen 81; server_name test.local; root /var/www/html; location / { proxy_hide_header X-Frame-Options; proxy_set_header X-Forwarded-Proto $scheme; add_header 'Access-Control-Allow-Origin' $alloworigin; add_header 'Access-Control-Allow-Credentials' 'true'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; } } – Jurudocs Nov 26 '17 at 19:41
  • Please give more details on "can't get this working". What exactly is happening? Please also edit additional information to the original question so that it can be properly formatted. Please also show the complete conf.d file. – Tero Kilkanen Nov 26 '17 at 20:57
  • got it working! This was due to a problem of caching ;-P. There is an interesting behavior. If I do a request to that domain it somehow caches the result of the map function. So if i send a request from a different domain the former referrer is still in the allow origin... And put no-cache headers into location block doesnt help – Jurudocs Nov 26 '17 at 21:40
  • Did you confirm the behaviour with CURL? It is most likely the browser that caches the behaviour, not the web server.. – Tero Kilkanen Nov 28 '17 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.