How can I get round the CORS issue (Self Hosted)

[SamB-GB]

I have this self hosted but still encounter the CORS issue when on sub domains...

Access to fetch at 'https://sub.mydomain.com/' from origin 'https://sub.mydomain.com/' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

[air3ijai]

⚠️ Please make sure to use SSL and adjust configuration by your needs ⚠️

A quick workaround to test how it works.

steps and details

1. Download GeoLite DBs and put them into geodb folder

2. Create nginx.conf file

   vi nginx.conf

   user                nginx;
   worker_processes    auto;
   
   error_log    /var/log/nginx/error.log notice;
   pid          /var/run/nginx.pid;
   
   events {
       worker_connections    1024;
       accept_mutex          off;
       use                   epoll;
   }
   
   http {
       include         /etc/nginx/mime.types;
       default_type    application/octet-stream;
   
       log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                         '$status $body_bytes_sent "$http_referer" '
                         '"$http_user_agent" "$http_x_forwarded_for"';
   
       access_log  /var/log/nginx/access.log  main;
   
       sendfile             on;
       keepalive_timeout    65;
   
       upstream echoip {
           server    echoip:8080 fail_timeout=0;
       }
   
       server {
   
           location / {
               proxy_set_header    X-Forwarded-For      $proxy_add_x_forwarded_for;
               proxy_set_header    X-Forwarded-Proto    $scheme;
               proxy_set_header    Host                 $host;
               proxy_redirect      off;
               proxy_pass          http://echoip/;
   
               proxy_set_header    X-Forwarded-Host    $server_name;
               proxy_set_header    X-Real-IP           $remote_addr;
   
               # Preflighted requests
               if ($request_method = OPTIONS ) {
                   add_header 'Access-Control-Allow-Origin'  '*';
                   add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, HEAD';
                   add_header 'Access-Control-Allow-Headers' 'Authorization, Origin, X-Requested-With, Content-Type, Accept';
   
                   return 200;
               }
   
               if ($request_method ~* '(GET|POST)') {
                   add_header 'Access-Control-Allow-Origin' '*';
               }
           }
       }
   }

3. Create docker-compose.yaml file

   vi docker-compose.yaml

   services:
     # echoip
     echoip:
       image: mpolden/echoip
       container_name: echoip
       pull_policy: always
       command:
         - -l
         - :8080
         - -p
         - -H
         - X-Real-IP
         - -r
         - -t
         - html
         - -a
         - /geodb/GeoLite2-ASN.mmdb
         - -c
         - /geodb/GeoLite2-City.mmdb
         - -f
         - /geodb/GeoLite2-Country.mmdb
       volumes:
         - ./geodb:/geodb
       logging:
         driver: json-file
         options:
           max-size: 100m
           max-file: 5
       networks:
         - echoip
   
     # Nginx
     nginx:
       image: nginx
       container_name: nginx
       ports:
         - 80:80
       volumes:
         - ./nginx.conf:/etc/nginx/nginx.conf
       logging:
         driver: json-file
         options:
           max-size: 100m
           max-file: 5
       networks:
         - echoip
   
   networks:
     echoip:
       driver: bridge

4. Run the following command to start the services

   docker-compose up -d

5. Test the service
   http://localhost

Actually that feature was added Sep 17, 2015 and removed Apr 17, 2016

• add hostname lookup #7
• CORS support #17
• Add Access-Control-Allow-* headers #49
• Unable to access it from a webapp #119

It would be very useful to have a native cli argument for that (-x, --cors), to make testing easier.