Home / server / Questions / 350330
Accepted
Gajus
Asked: 2012-01-17 08:14:00 +0800 CST

NGINX add_header, adding multiple headers

  • 772

I am trying to send multiple headers

add_header Access-Control-Allow-Origin http://dev.anuary.com;
add_header Access-Control-Allow-Origin https://dev.anuary.com;

However, instead NGINX makes them into

Access-Control-Allow-Origin: http://dev.anuary.com, https://dev.anuary.com

What's the solution?

nginx

2 Answers

  1. Best Answer

    Well, yes, nginx is combining the identically named headers.. but it's doing so in accordance with the HTTP spec. See section 4.2.

    The header:

    Access-Control-Allow-Origin: http://dev.anuary.com, https://dev.anuary.com

    Is, according to the HTTP/1.1 spec, functionally equivalent to:

    Access-Control-Allow-Origin: http://dev.anuary.com
Access-Control-Allow-Origin: https://dev.anuary.com

    If you have a system or application that is capable of reading one format and not the other, then it's the problem. nginx is doing it right.

    EDIT:

    The Mozilla documentation states that there can only be one Access-Control-Allow-Origin header.

    The formatting of it (see here) should be a space-delimited list of origins:

    add_header Access-Control-Allow-Origin "http://dev.anuary.com https://dev.anuary.com";

    But really, you're supposed to be echoing the Origin header supplied by the client instead of generating one out of the blue. This is probably more appropriate:

    if ($http_origin ~* "^https?://dev\.anuary\.com$" ) {
    add_header Access-Control-Allow-Origin $http_origin;
}
    • 35

  2. I was facing the same issue as multiple sub domains in my network trying to access resources and nginx was not setup properly. Here is how I fixed it. 

    add_header Access-Control-Allow-Origin https://*.your-domain-name.com;

    I hope this helps.

    • -3