-
-
Save adriennn/9a2353a41e463c7315eb to your computer and use it in GitHub Desktop.
nginx configuration for CORS (Cross-Origin Resource Sharing), with an origin whitelist, and HTTP Basic Access authentication allowed
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # A CORS (Cross-Origin Resouce Sharing) config for nginx | |
| # see details at https://gist.github.com/himyouten/df57b21958fba9c75ea7 | |
| if ($http_origin ~* (https?://.*\.garbagepla\.net(:[0-9]+)?)) { | |
| rewrite ^ /__cors__/$request_method$uri last; | |
| } | |
| location /__cors__/GET/ { | |
| add_header 'Access-Control-Allow-Origin' "$http_origin"; | |
| add_header 'Access-Control-Allow-Credentials' 'true'; | |
| # add_header 'Access-Control-Expose-Headers' 'customresponseheader'; | |
| rewrite ^/__cors__/GET/(.*)$ /$1 last; | |
| } | |
| location /__cors__/POST/ { | |
| add_header 'Access-Control-Allow-Origin' "$http_origin"; | |
| add_header 'Access-Control-Allow-Credentials' 'true'; | |
| # add_header 'Access-Control-Expose-Headers' 'cutomresponseheader'; | |
| rewrite ^/__cors__/POST/(.*)$ /$1 last; | |
| } | |
| location /__cors__/OPTIONS/ { | |
| add_header 'Access-Control-Allow-Origin' "$http_origin"; | |
| add_header 'Access-Control-Allow-Credentials' 'true'; | |
| add_header 'Access-Control-Max-Age' 1728000; | |
| add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; | |
| add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since'; | |
| add_header 'Content-Length' 0; | |
| add_header 'Content-Type' 'text/plain charset=UTF-8'; | |
| return 204; | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment