Just include in your nginx.conf inside location block to enable CORS, I assume that you have more_set_headers plugin compiled

cors

# nginx does not allow add_headers inside if unless its location
set $cors "true";

# Nginx doesn't support nested If statements. This is where things get slightly nasty.
# Determine the HTTP request method used

if ($request_method = 'OPTIONS') {
  set $cors "${cors}options";
}
if ($request_method = 'GET') {
  set $cors "${cors}get";
}
if ($request_method = 'POST') {
  set $cors "${cors}post";
}

if ($cors = "true") {
# Catch all incase there's a request method we're not dealing with properly
  add_header 'Access-Control-Allow-Origin' "$http_origin";
}

if ($cors = "trueget") {
  add_header 'Access-Control-Allow-Origin' "$http_origin";
  add_header 'Access-Control-Allow-Credentials' 'true';
  add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, PATCH, DELETE';
  add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Auth-Token';
}

if ($cors = "trueoptions") {
  add_header 'Access-Control-Allow-Origin' "$http_origin";

#
# Om nom nom cookies
#

  add_header 'Access-Control-Allow-Credentials' 'true';
  add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, PATCH, DELETE';

#
# Custom headers and headers various browsers *should* be OK with but aren't
#

  add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Auth-Token';

#
# Tell client that this pre-flight info is valid for 20 days
#

  add_header 'Access-Control-Max-Age' 1728000;
  add_header 'Content-Type' 'text/plain charset=UTF-8';
  add_header 'Content-Length' 0;
  return 204;
}

if ($cors = "truepost") {
  add_header 'Access-Control-Allow-Origin' "$http_origin";
  add_header 'Access-Control-Allow-Credentials' 'true';
  add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PUT, PATCH, DELETE';
  add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Auth-Token';
}

more_set_headers -s '400 401 402 403 404 405 500 502 503' 'Access-Control-Allow-Origin: *';