CORS error

[arladmin]

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • Yes
• Are you sure you're not using someone else's docker image?
  • Yes
• Have you searched for similar issues (both open and closed)?
  • Yes

Describe the bug

I keep running into CORS issues with my app (which is behind Nginx Proxy Manager).

Response to preflight request doesn't pass access control check: The 'Access-Control-Allow-Origin' header contains multiple values '*, *', but only one is allowed.

Nginx Proxy Manager Version

2.9.19

To Reproduce

This is my config, under Custom Locations (location = '/')

proxy_set_header X-Forwarded-Host $host:$server_port;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Connection '';
chunked_transfer_encoding off;
proxy_buffering off;
proxy_cache off;

add_header 'Access-Control-Allow-Origin' '*';
add_header 'Access-Control-Allow-Credentials' 'true';
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,Accept';

This is the response in the browser, for the OPTIONS api call:

---

If i change the config to this:

proxy_set_header X-Forwarded-Host $host:$server_port;
proxy_set_header X-Forwarded-Proto https;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Connection '';
chunked_transfer_encoding off;
proxy_buffering off;
proxy_cache off;

then the response becomes this-->

---

What could be the issue here? And how do i go about resolving it?

Thanks.

[arladmin]

Any insights, anyone?

[mebonline]

Use this

add_header 'Access-Control-Allow-Origin' '*'; add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; add_header 'Access-Control-Allow-Headers' 'User-Agent,Keep-Alive,Content-Type'; add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';

[CampAsAChamp]

Hey any updates on this? I'm getting the same issues. My headers are not getting added. Or they seem to get added twice, which also breaks CORS.

[kmanwar89]

Hey there,

I think I may also be facing a similar issue using NPM with the "Your_Spotify" self-hosted dashboard - everything works when I use localhost redirects for Oauth, but as soon as I redirect via my FQDN, I get CORS errors. I tried adding the headers mentioned above, but to no effect

Specifically, it's an SSL cipher mismatch error which seems to be caused by the CORS misbehavior:

[mebonline]

Try edit data/nginx/proxy_host/x.conf (x means your website id 1 or 2 or 3 etc.,) like this

# ------------------------------------------------------------
# abc.domain.com
# ------------------------------------------------------------

map $scheme $hsts_header {
    https   "max-age=63072000; preload";
}

server {
  set $forward_scheme http;
  set $server         "xxx.xxx.xxx.xxx";
  set $port           xxxx;

  listen 80;
listen [::]:80;

  server_name abc.domain.com;

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;

  access_log /data/logs/proxy-host-1_access.log proxy;
  error_log /data/logs/proxy-host-1_error.log warn;

  location / {

    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto  $scheme;
    proxy_set_header X-Forwarded-For    $remote_addr;
    proxy_set_header X-Real-IP      $remote_addr;

    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;

add_header 'Access-Control-Allow-Origin' '*';
add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'User-Agent,Keep-Alive,Content-Type';
add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';    

    # Proxy!
    include conf.d/include/proxy.conf;
  }

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

[arladmin]

This issue still exists in v2.11.2!

[arladmin]

Additionally, don't know why, but after editing the x.conf file manually, the following config resolves this issue:

server {
   ...

   add_header 'Access-Control-Allow-Origin' $http_origin always;

   add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
   add_header 'Access-Control-Allow-Headers' 'User-Agent,Keep-Alive,Content-Type' always;
   add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;
   ...
   location / {
      ...
          proxy_hide_header 'access-control-allow-origin';    
      ...
   }
}

Now, the issue that remains is: it's seemingly not possible to set the above config via the GUI. Because, if any config added via the 'Custom Locations' setting, goes into the location block only.

---

@jc21

Why is this so? And, how to be able to set this config via GUI itself?

[Frittenstaebchen]

Additionally, don't know why, but after editing the x.conf file manually, the following config resolves this issue:

server {
   ...

   add_header 'Access-Control-Allow-Origin' $http_origin always;

   add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
   add_header 'Access-Control-Allow-Headers' 'User-Agent,Keep-Alive,Content-Type' always;
   add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;
   ...
   location / {
      ...
          proxy_hide_header 'access-control-allow-origin';    
      ...
   }
}

Now, the issue that remains is: it's seemingly not possible to set the above config via the GUI. Because, if any config added via the 'Custom Locations' setting, goes into the location block only.

@jc21

Why is this so? And, how to be able to set this config via GUI itself?

today i had a similar issue, just added a "custom locations" in that particular proxy host via. web gui

location : "/" Scheme, Hostname and Forward Port exactly the same as in Details

Press the gear symbol and i added the following in the "custom NGINX configuration" field:

add_header 'Access-Control-Allow-Origin' '*';

add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

add_header 'Access-Control-Allow-Headers' 'User-Agent,Keep-Alive,Content-Type';

add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';

after that change, the CORS issue was gone and my homer dashboard finaly showed the uptime value