How do you handle CORS in Nginx?

A browser blocks a cross-origin response unless the server opts in with CORS headers. For non-simple requests it first sends an OPTIONS preflight, which Nginx can answer directly instead of forwarding to the backend.

map $http_origin $cors_origin {
    default "";
    "https://app.example.com" $http_origin;
}

server {
    location /api/ {
        add_header Access-Control-Allow-Origin $cors_origin always;
        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;
        add_header Access-Control-Allow-Credentials "true" always;
        add_header Vary "Origin" always;

        if ($request_method = OPTIONS) {
            return 204;
        }

        proxy_pass http://backend;
    }
}

Rules that prevent breakage

• The allow-origin value must match the requesting origin exactly, or be a wildcard without credentials
• Credentials require a specific origin and Access-Control-Allow-Credentials: true
• Preflight needs allowed methods and allowed request headers
• Vary: Origin keeps caches from serving one origin's response to another
• CORS does not protect an API from non-browser clients; keep authentication and authorization server-side