title: nginx - add_header gets overwritten
body: <p>I'm having a very hard time understanding exactly when nginx overwrites my add_header directives.</p>
  
  <p>I have the following:</p>
  
  <pre><code>include /etc/nginx/vhost.d/ihc.example.com;
  location = /auth {
      proxy_pass http://sso.example.com/auth/login;
      proxy_pass_request_body off;
      proxy_set_header Content-Length "";
      proxy_set_header X-Original-URI $request_uri;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
  }
  location / {
          auth_request /auth;
          auth_request_set $saved_set_cookie $upstream_http_set_cookie;
          add_header Set-Cookie $saved_set_cookie; #I don't see this header in the response
          proxy_pass http://ihc.example.com;
          include /etc/nginx/vhost.d/ihc.example.com_location;
  }
  </code></pre>
  
  <p>The problem I'm having is that the <code>auth_request_set $saved_set_cookie $upstream_http_set_cookie;</code> cookie doesn't appear in the response.</p>
  
  <p>Now if I remove the <code>include /etc/nginx/vhost.d/ihc.example.com_location;</code> line, it will appear, but this file contains a shared CORS fix that I would really, really like to keep:</p>
  
  <pre><code>if ($cors = 'trueGET') {
      add_header 'Access-Control-Allow-Origin' $http_origin; #I see this header in the response
  [...]
  </code></pre>
  
  <p>How can I achieve both without having to repeat the CORS headers in every location? And what is causing this to become overwritten? As I read the documentation, <code>location</code> should overwrite <code>server</code>, but in this case, what is causing this new "scope"?</p>