'Access-Control-Allow-Origin' header contains multiple values - nginx + sails.js

Question

I'm going across two domains using Chrome browser:

• client: http://vb.localhost:909 (angular.js)
• backend: http://db.localhost:909/matches (sails.js, node app on port 1337)

everything is served by nginx.

I get the following error:

XMLHttpRequest cannot load http://db.localhost:909/matches. The 'Access-Control-Allow-Origin' header contains multiple values ', *', but only one is allowed. Origin 'http://vb.localhost:909' is therefore not allowed access.

Here's the nginx.conf for both server blocks:

 server {
   listen       909;
   server_name  vb.localhost;     

   location / {
       root   "\apps\vb-site\UI\dev";
       index  index.html;
   }
}
server {
   listen 909;
   server_name  db.localhost;
   add_header Access-Control-Allow-Origin *;

   location / {
    proxy_pass http://127.0.0.1:1337;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;

   }

}

In the sails.js app, in the config/cors.js file, I've allowed all domains CORS access:

 origin: '*',

It looks like a blank domain is being added before the wildcard '*' is added in the db.localhost server block of nginx since the error in Chrome is: ', *' <- notice the empty char, then commma, then * (wildcard)

Where am I going wrong in the configuration?

Answer 1

Sails.js takes care of this on the sails.js server side. There was no need to add a 'Access-Control-Allow-Origin *' header on nginx.

server {
   listen 909;
   server_name  db.localhost;
   add_header Access-Control-Allow-Origin *; # <-this line not necessary 

   location / {
    proxy_pass http://127.0.0.1:1337;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;

   }

It was only a matter of adding the correct property in the config/cors.js file, to allow all domains CORS access:

   allRoutes: true, // <-this line necessary!