cors gives you easy control over Cross Origin Resource Sharing for your site.
It allows you to whitelist particular domains per route, or to simply allow all domains *
If desired you may customize nearly every aspect of the specification.
cors [path] [domains...] {
origin [origin]
origin_regexp [regexp]
methods [methods]
allow_credentials [allowCredentials]
max_age [maxAge]
allowed_headers [allowedHeaders]
exposed_headers [exposedHeaders]
}
Origin
header. Access will be granted accordingly. It can be used in conjonction with the origin
config (executed as a fallback to origin
). May be specified multiple times or ommitted.Simply allow all domains to request any path:
cors
Protect specific paths only, and only allow a few domains:
cors /foo http://mysite.com http://anothertrustedsite.com
Full configuration:
cors / {
origin http://allowedSite.com
origin http://anotherSite.org https://anotherSite.org
origin_regexp .+\.example\.com$
methods POST,PUT
allow_credentials false
max_age 3600
allowed_headers X-Custom-Header,X-Foobar
exposed_headers X-Something-Special,SomethingElse
}