I have this configuration in my Nginx
server {
listen 8080;
add_header Access-Control-Allow-Origin *;
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'Content-Type';
}
Now I have my web application which does GET and POST for GET It works fine but if I do Ajax POST I get this error
XMLHttpRequest cannot load 'URL' . Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'Origin' is therefore not allowed access. The response had HTTP status code 404.
If I do a 'GET' request I can see this in my response.
Access-Control-Allow-Headers:Content-Type
Access-Control-Allow-Methods:GET, POST, OPTIONS
Access-Control-Allow-Origin:*
But if I make a post I don't see any of that.
I had the same issue and got it solve by adding the keyword always to my add_header directive. As stated by the documentation:
add_header: Adds the specified field to a response header provided that the response code equals 200, 201, 204, 206, 301, 302, 303, 304, or 307. [...]If the
alwaysparameter is specified (1.7.5), the header field will be added regardless of the response code.
What was happening is that, without always, my GET request were returned 200 and thus had the expected headers, while my POST was getting a 400, thus without the headers and thus triggering CORS errors.