CORS and non 200 statusCode

Question

I have CORS working well with Nginx. The APIs are design to send non 200 status code - example 401, 404 etc - for bad input. The problem is that Chrome cancels / abort the request if it receives a non 200 status code. Due to this reason, I am not able to show the exact error on the Web client.

What is the way around for CORS non 200 status code errors?

Answer 1

By default Nginx only adds headers for requests it considers successful. You can make it add the header without regard for the response code, by adding the always parameter to your add_header directive, e.g.

add_header 'Access-Control-Allow-Origin' '*' always;

Answer 2

You need to use the more_set_headers module.

with -s you can scpecify more status code

more_set_headers -s '404,400,403' 'Access-Control-Allow-Origin: http://domain.com';

However if you don't have installed this module in nginx you need to recompile it. to compile it :

wget http://nginx.org/download/nginx-1.7.8.tar.gz
git clone https://github.com/openresty/headers-more-nginx-module.git
tar -xzvf nginx-1.7.8.tar.gz
cd nginx-1.7.8
./configure --prefix=/opt/nginx --add-module=/path/to/headers-more-nginx-module
make
make install