Example preflight for CORs

gistfile1.txt

if ($request_method = 'GET') {
  add_header 'Access-Control-Allow-Origin' "$http_origin";
}

if ($request_method = 'POST') {
  add_header 'Access-Control-Allow-Origin' "$http_origin";
}

if ($request_method = 'OPTIONS') {
  add_header 'Access-Control-Allow-Origin' "$http_origin";
  add_header 'Access-Control-Max-Age' 3600;
  add_header 'Access-Control-Allow-Methods' 'GET, PUT, PATCH, POST, DELETE, OPTIONS';
  add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type ,Accept, Origin, User-Agent, DNT, Cache-Control, Keep-Alive, X-Requested-With, If-Modified-Since';
  
  # Help-out finicky browsers
  add_header 'Content-Length' 0;
  add_header 'Content-Type' 'text/plain charset=UTF-8';
  return 204;
}