title: Configuring CORS for nginx and passenger
body: <p>I'm have an Rails application with Angular. I'm using nginx and passenger as a server. The idea is that angular makes requests to the api.app.com. When I try to do this I get this error.</p>
  
  <blockquote>
    <p>XMLHttpRequest cannot load <a href="https://api.app.com/api/some_resource" rel="nofollow">https://api.app.com/api/some_resource</a>. Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin '<a href="https://www.app.com" rel="nofollow">https://www.app.com</a>' is therefore not allowed access. The response had HTTP status code 404.`</p>
  </blockquote>
  
  <p>My current nginx configuration handles CORS requests this way: </p>
  
  <pre><code>server {
      location / {
          set $cors '';
  
          if ($http_origin ~* 'https?://(localhost|www\.app-staging\.com|www\.app\.com|api.app.com|app.com)') {
              set $cors 'true';
          }
  
          proxy_set_header Host $http_host;
  
          if ($cors = 'true') {
              add_header 'Access-Control-Allow-Origin' "$http_origin";
              add_header 'Access-Control-Allow-Credentials' 'true';
              add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS';
              #add_header 'Access-Control-Allow-Headers' 'Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqTok$
          }
      }
  }
  </code></pre>
  
  <p>What I'm doing wrong?</p>