Differences

This shows you the differences between two versions of the page.

--- wiki:allowing_cors_requests [2024/10/14 10:08] – [nginx] update header values antisa
+++ wiki:allowing_cors_requests [2026/09/15 10:54] (current) – [Allowing CORS requests] add info about only needing one type of requests antisa
@@ Line 10: / Line 10: @@
 Below is a config for preflighted and simple requests which will allow requests (e.g. from fetch function in browser console) from **example.org** domain to the domain **example.com**
+<WRAP center round info 60%>
+You might only need the preflighted requests (if clause) if you notice duplicate **access-control-** headers being returned.
+</WRAP>
 ===== nginx =====
@@ Line 28: / Line 33: @@
 if ($request_method = 'OPTIONS') {
   add_header 'X-preflighted' 'true';
-  add_header 'Access-Control-Allow-Origin' example.org always;
+  add_header 'Access-Control-Allow-Origin' https://example.org always;
   add_header 'Access-Control-Allow-Credentials' 'true';
   add_header 'Access-Control-Allow-Headers' 'Origin, Content-Type, Accept, Authorization';
@@ Line 35: / Line 40: @@
 }
-add_header 'Access-Control-Allow-Origin' example.org always;
+add_header 'Access-Control-Allow-Origin' https://example.org always;
 add_header 'Access-Control-Allow-Credentials' 'true';
 add_header 'Access-Control-Allow-Headers' 'Origin, Content-Type, Accept, Authorization';
-add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
+add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
@@ Line 53: / Line 58: @@
 }
 </code>
+<WRAP center round tip 60%>
+If you are also setting a cookie, remember that it can only be set from the same domain i.e. if there's an app running under app.example.org and it sends ''Set-Cookie yummy=fe.example.com'', this won't work. You will get an error like ''Cookie “yummy” has been rejected for invalid domain.''
+</WRAP>
 ====== Tested on ======