How to make nginx CORS configuration work when server returns error?

Question

I want to add CORS to my server.

I have configured my nginx according to this: https://michielkalkman.com/snippets/nginx-cors-open-configuration.html

It seems to work fine when the server returns 200. However, if the server returns something else, like 400 when the request is wrong, or 500 if internal error, the browser shows the No 'Access-Control-Allow-Origin' header instead of reaching the error handler like it should.

What configuration am I missing to make it work?

Answer 1

Since version 1.7.5 you can use the always keyword to return the headers regardless of the response code:

add_header 'Access-Control-Allow-Origin' '*' always;

http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header

Answer 2

This has been answered before: https://serverfault.com/questions/431274/nginx-services-fails-for-cross-domain-requests-if-the-service-returns-error.

add-header doesn't work with HTTP errors, but the optional headers_more module can be used to workaround this limitation.