I'm trying to use wide-open CORS configuration for Nginx. Since i started to use this configuration Nginx only serves an empty response with 200 status code. I'm using Nginx with PHP-FPM. I have already checked and there is nothing wrong with the code itself i can say that because i have put some HTTP responses on text files. On the text files i have the correct HTTP responses but they are not sent to the client by Nginx.

Here is the configuration:

location / {
    if ($request_method = 'OPTIONS') {
        add_header 'Access-Control-Allow-Origin' '*'  always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'  always;
        # Custom headers and headers various browsers *should* be OK with but aren't
        add_header 'Access-Control-Allow-Headers' 'x-authorization,Filename,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,content-type,Range'  always;
        # Tell client that this pre-flight info is valid for 20 days
        add_header 'Access-Control-Max-Age' 1728000  always;
        add_header 'Content-Type' 'text/plain; charset=utf-8'  always;
        add_header 'Content-Length' 0  always;
        return 204;

    if ($request_method = 'GET') {
        add_header 'Access-Control-Allow-Origin' '*'  always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'  always;
        add_header 'Access-Control-Allow-Headers' 'x-authorization,Filename,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,content-type,Range' always;
        add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;

    include /etc/nginx/fastcgi_params;

    fastcgi_param SCRIPT_FILENAME $realpath_root/app_dev.php$is_args$args;
    fastcgi_param DOCUMENT_ROOT $realpath_root;

    fastcgi_split_path_info ^(.+\.php)(/.*)$;
    fastcgi_pass php-fpm:9000;

I'm testing the configs just for GET requests at the moment.

I have tried to make HTTP requests with google chrome and the Insomnia REST client and with both clients the same behaviour ocurr.

I have also tried to solve the CORS issues at the application level with the framework i'm using ( Symfony 3.4 ). But considering a file upload, who makes the upload of the file is the Nginx and i only have access to request with the file after the file is completed uploaded by Nginx, but when the file exceeds the maximum size i don't even have access to the request at the framework level and this is why i can't set the CORS headers.

I would like to make it clear that the HTTP requests are getting in to the code correctly and the correct HTTP responses are being computed, but the HTTP responses are not being sent to the client by the Nginx.

The headers i'm using on the HTTP requests are on the list of headers on the Access-Control-Allow-Headers header.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.