title: How to allow CORS on NGINX
body: <p>So I want my domain <code>scanner-api.local</code> to accept file sent from mobile device/web apps .</p>
  
  <p>I was getting </p>
  
  <p>following error</p>
  
  <blockquote>
    <p>MLHttpRequest cannot load <a href="http://scanner-api.local/upload" rel="nofollow noreferrer">http://scanner-api.local/upload</a>. No
    'Access-Control-Allow-Origin' header is present on the requested
    resource. Origin '<a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a>' is therefore not allowed
    access.</p>
  </blockquote>
  
  <p>I tried to add following in my Nginx server but its not working , Nginx is crashing </p>
  
  <p><strong>code</strong></p>
  
  <pre><code>server {
      listen 80;
      listen [::]:80;
  
      # SSL configuration
      #
      # listen 443 ssl default_server;
      # listen [::]:443 ssl default_server;
      #
      # Note: You should disable gzip for SSL traffic.
      # See: https://bugs.debian.org/773332
      #
      # Read up on ssl_ciphers to ensure a secure configuration.
      # See: https://bugs.debian.org/765782
      #
      # Self signed certs generated by the ssl-cert package
      # Don't use them in a production server!
      #
      # include snippets/snakeoil.conf;
  
      root /var/www/stock_scan_api/public/;
  
      # Add index.php to the list if you are using PHP
      index index.php index.html index.htm  index.nginx-debian.html;
  
      server_name scanner-api.local;
  
      #location / {
      #   # First attempt to serve request as file, then
      #   # as directory, then fall back to displaying a 404.
      #   try_files $uri $uri/ =404;
      #}
  
      location / {
                  # First attempt to serve request as file, then
                  # as directory, then fall back to displaying a 404.
                  try_files $uri $uri/ /index.php?$query_string;
                  # Uncomment to enable naxsi on this location
                  # include /etc/nginx/naxsi.rules
          }
  
      # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
      #
      location ~ \.php$ {
          include snippets/fastcgi-php.conf;
  
          # With php7.0-cgi alone:
      #   fastcgi_pass 127.0.0.1:9000;
      #   # With php7.0-fpm:
          fastcgi_pass unix:/run/php/php7.0-fpm.sock;
      }
  
      # deny access to .htaccess files, if Apache's document root
      # concurs with nginx's one
      #
      #location ~ /\.ht {
      #   deny all;
      #}
  location / {
    if ($request_method = 'OPTIONS') {
      add_header 'Access-Control-Allow-Origin' '*';
      add_header 'Access-Control-Allow-Credentials' 'true';
      add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
      add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
      add_header 'Access-Control-Max-Age' 1728000;
      add_header 'Content-Type' 'text/plain charset=UTF-8';
      add_header 'Content-Length' 0;
      return 204;
    }
    if ($request_method = 'POST') {
      add_header 'Access-Control-Allow-Origin' '*';
      add_header 'Access-Control-Allow-Credentials' 'true';
      add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
      add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
    if ($request_method = 'GET') {
      add_header 'Access-Control-Allow-Origin' '*';
      add_header 'Access-Control-Allow-Credentials' 'true';
      add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
      add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
  }
  }
  </code></pre>
  
  <p>What could be the error in this ?</p>