Skip to content

Instantly share code, notes, and snippets.

@antonbabenko
Last active November 18, 2023 20:22
Show Gist options
  • Save antonbabenko/8903578 to your computer and use it in GitHub Desktop.
Save antonbabenko/8903578 to your computer and use it in GitHub Desktop.
(nginx AND varnish) + CORS (working example)
more_set_headers "Access-Control-Allow-Origin: $http_origin";
more_set_headers "Access-Control-Allow-Credentials: true";
# OPTIONS indicates a CORS pre-flight request
if ($request_method = 'OPTIONS') {
more_set_headers "Access-Control-Max-Age: 1728000";
more_set_headers "Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS";
more_set_headers "Access-Control-Allow-Headers: Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since";
more_set_headers "Content-Length: 0";
more_set_headers "Content-Type: text/plain charset=UTF-8";
return 204;
}
sub vcl_deliver {
set resp.http.Access-Control-Allow-Origin = "*";
set resp.http.Access-Control-Allow-Credentials = "true";
if (req.method == "OPTIONS") {
set resp.http.Access-Control-Max-Age = "1728000";
set resp.http.Access-Control-Allow-Methods = "GET, POST, PUT, DELETE, PATCH, OPTIONS";
set resp.http.Access-Control-Allow-Headers = "Authorization,Content-Type,Accept,Origin,User-Agent,DNT,Cache-Control,X-Mx-ReqToken,Keep-Alive,X-Requested-With,If-Modified-Since";
set resp.http.Content-Length = "0";
set resp.http.Content-Type = "text/plain charset=UTF-8";
set resp.status = 204;
}
}
@anicething
Copy link

how to use this?

@blindpet
Copy link

@anicething all I did was add

set resp.http.Access-Control-Allow-Origin = "*";

in vcl_deliver and got the needed result

@cedatif
Copy link

cedatif commented Dec 5, 2017

For safari, set resp.status = 200; otherwise it doesn't work ...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment