title: Allow CORS on Nginx to work with AngularJS HTTP GET
body: <p>I keep getting this error in my console:</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load
    <a href="http://d.biossusa.com/api/distributor?key=" rel="nofollow noreferrer">http://d.biossusa.com/api/distributor?key=</a>****. No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin 'null' is therefore not allowed access.</p>
  </blockquote>
  
  <p>I know that I have a CORS issue. I am trying to fix it. Please see my steps below.</p>
  
  <hr>
  
  <h2>First tries</h2>
  
  <p>I've tried adding the config on my front-end side. </p>
  
  <pre><code>&lt;script type="text/javascript" src="https://code.jquery.com/jquery-1.12.4.js"&gt;&lt;/script&gt;
  &lt;script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.4.8/angular.min.js"&gt;&lt;/script&gt;
  
  &lt;div ng-app="myApp" ng-controller="myCtrl"&gt;
  
    &lt;p&gt;Today's welcome message is:&lt;/p&gt;
    &lt;h1&gt;{{myData}}&lt;/h1&gt;
  
  &lt;/div&gt;
  
  &lt;script&gt;
  
    var app = angular.module('myApp', []);
  
    app.config(['$httpProvider', function($httpProvider) {
      $httpProvider.defaults.useXDomain = true;
      delete $httpProvider.defaults.headers.common['X-Requested-With'];
    }
  
    ]);
  
    app.controller('myCtrl', function($scope, $http) {
      $http.get("http://d.biossusa.com/api/distributor?key=****")
      .then(function(response) {
          $scope.myWelcome = response.data;
      });
  });
  
  
  &lt;/script&gt;
  </code></pre>
  
  <hr>
  
  <p>I've tried adding the config on my back-end service side on my Nginx Configs. </p>
  
  <p>I found this link on Nginx site = <a href="https://enable-cors.org/server_nginx.html" rel="nofollow noreferrer">https://enable-cors.org/server_nginx.html</a> </p>
  
  <p>I've add that in my nginx config like this. </p>
  
  <pre><code>server {
  
      listen 80;
      server_name d.biossusa.com;
      root /home/forge/d.biossusa.com/distributor-application/laravel/public;
  
      # Enable this line for debugging to see which php.ini get use ... $php --ini
      # root /home/forge/d.biossusa.com/public;
  
  
      # FORGE SSL (DO NOT REMOVE!)
      # ssl_certificate;
      # ssl_certificate_key;
  
      index index.html index.htm index.php;
  
      charset utf-8;
  
      location / {
          try_files $uri $uri/ /index.php?$query_string;
  
          if ($request_method = 'OPTIONS') {
              add_header 'Access-Control-Allow-Origin' '*';
              add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
              #
              # Custom headers and headers various browsers *should* be OK with but aren't
              #
              add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
              #
              # Tell client that this pre-flight info is valid for 20 days
              #
              add_header 'Access-Control-Max-Age' 1728000;
              add_header 'Content-Type' 'text/plain charset=UTF-8';
              add_header 'Content-Length' 0;
              return 204;
           }
  
  
           if ($request_method = 'POST') {
              add_header 'Access-Control-Allow-Origin' '*';
              add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
              add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
              add_header 'Access-Control-Expose-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
           }
  
  
           if ($request_method = 'GET') {
              add_header 'Access-Control-Allow-Origin' '*';
              add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
              add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
              add_header 'Access-Control-Expose-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
           }
  
  
      }
  
      location = /favicon.ico { access_log off; log_not_found off; }
      location = /robots.txt  { access_log off; log_not_found off; }
  
      access_log off;
      error_log  /var/log/nginx/d.biossusa.com-error.log error;
  
      error_page 404 /index.php;
  
      location ~ \.php$ {
  
          fastcgi_split_path_info ^(.+\.php)(/.+)$;
          fastcgi_pass unix:/var/run/php5-fpm.sock;
          fastcgi_read_timeout 600;
         fastcgi_send_timeout 600;
         fastcgi_buffers 16 16k;
         fastcgi_buffer_size 32k;
          fastcgi_index index.php;
          include fastcgi_params;
  
      }
  
      location ~ /\.ht {
          deny all;
      }
  
  }
  </code></pre>
  
  <p>I don't know what else I could do to get rid of this error.</p>
  
  <hr>
  
  <h1>2nd Try</h1>
  
  <p>Updated Nginx Settings based on @Yaser Answer:</p>
  
  <pre><code>server {
  
      listen 80;
      server_name d.biossusa.com;
      root /home/forge/d.biossusa.com/distributor-application/laravel/public;
  
      index index.html index.htm index.php;
  
      charset utf-8;
  
      location / {
         set $cors '';
         if ($http_origin ~ '^http?://(www\.d.biossusa\.com)') {
                 set $cors 'true';
         }
  
         if ($cors = 'true') {
                 add_header 'Access-Control-Allow-Origin' "$http_origin" always;
                 add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
         }
      }
  
      location = /favicon.ico { access_log off; log_not_found off; }
      location = /robots.txt  { access_log off; log_not_found off; }
  
      access_log off;
      error_log  /var/log/nginx/d.biossusa.com-error.log error;
  
      error_page 404 /index.php;
  
      location ~ \.php$ {
  
          fastcgi_split_path_info ^(.+\.php)(/.+)$;
          fastcgi_pass unix:/var/run/php5-fpm.sock;
          fastcgi_read_timeout 600;
         fastcgi_send_timeout 600;
         fastcgi_buffers 16 16k;
         fastcgi_buffer_size 32k;
          fastcgi_index index.php;
          include fastcgi_params;
  
      }
  
      location ~ /\.ht {
          deny all;
      }
  
  }
  </code></pre>
  
  <p><strong>Result :</strong> </p>
  
  <p><code>XMLHttpRequest cannot load http://d.biossusa.com/api/distributor?key=****. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access. The response had HTTP status code 404.</code></p>
  
  <hr>
  
  <h1>3rd Try</h1>
  
  <pre><code>server {
  
      listen 80;
      server_name d.biossusa.com;
      root /home/forge/d.biossusa.com/distributor-application/laravel/public;
  
      index index.html index.htm index.php;
  
      charset utf-8;
  
      location / {
  
         try_files $uri $uri/ /index.php?$query_string;
  
         set $cors '';
         if ($http_origin ~ '^http?://(www\.d.biossusa\.com)') {
                 set $cors 'true';
         }
  
         if ($cors = 'true') {
                 add_header 'Access-Control-Allow-Origin' "$http_origin" always;
                 add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
         }
      }
  
      location = /favicon.ico { access_log off; log_not_found off; }
      location = /robots.txt  { access_log off; log_not_found off; }
  
      access_log off;
      error_log  /var/log/nginx/d.biossusa.com-error.log error;
  
      error_page 404 /index.php;
  
      location ~ \.php$ {
  
          fastcgi_split_path_info ^(.+\.php)(/.+)$;
          fastcgi_pass unix:/var/run/php5-fpm.sock;
          fastcgi_read_timeout 600;
         fastcgi_send_timeout 600;
         fastcgi_buffers 16 16k;
         fastcgi_buffer_size 32k;
          fastcgi_index index.php;
          include fastcgi_params;
  
      }
  
      location ~ /\.ht {
          deny all;
      }
  
  }
  </code></pre>
  
  <p><strong>Result</strong> </p>
  
  <p><code>**XMLHttpRequest cannot load http://d.biossusa.com/api/distributor?key=****. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'null' is therefore not allowed access.**</code></p>