<p>I need to allow requests from multiple origins: <code>http://localhost:4200</code>, <code>http://localhost:4242</code>, etc., on nginx-ingress version 1.7.1. But I'm not able to do that for multiple origins, because <code>nginx.ingress.kubernetes.io/cors-allow-credentials: true</code> will not work with <code>nginx.ingress.kubernetes.io/cors-allow-origin: "*"</code>. It causes the browser to generate CORS error. Maybe someone has a solution for avoiding this error?</p>

<p>this is my config </p>

<pre><code> annotations:
kubernetes.io/ingress.class: "nginx"
nginx.ingress.kubernetes.io/enable-cors: "true"
nginx.ingress.kubernetes.io/cors-allow-origin: "*"
nginx.ingress.kubernetes.io/cors-allow-methods: "PUT, GET, POST, OPTIONS, DELETE"
nginx.ingress.kubernetes.io/cors-allow-headers: "DNT,X-CustomHeader,X-LANG,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Api-Key,X-Device-Id,Access-Control-Allow-Origin"
</code></pre>

<blockquote>
  <p>Access to XMLHttpRequest at '<a href="https://stage.site.com/api/session" rel="noreferrer">https://stage.site.com/api/session</a>' from
  origin '<a href="http://localhost:4200" rel="noreferrer">http://localhost:4200</a>' has been blocked by CORS policy: The
  value of the 'Access-Control-Allow-Origin' header in the response must
  not be the wildcard '*' when the request's credentials mode is
  'include'. The credentials mode of requests initiated by the
  XMLHttpRequest is controlled by the withCredentials attribute.</p>
</blockquote>

<p>Add the annotation to enable <code>CORS</code>:</p>

<pre><code>nginx.ingress.kubernetes.io/enable-cors: "true"
</code></pre>

<p>Be aware that <strong>the string "*" cannot be used for a resource that supports credentials</strong> (<a href="https://www.w3.org/TR/cors/#resource-requests" rel="noreferrer">https://www.w3.org/TR/cors/#resource-requests</a>), try with your domain list (comma separated) instead of *</p>
