Bird
Raised Fist0
Nginxdevops~5 mins

CORS configuration in Nginx - Time & Space Complexity

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Time Complexity: CORS configuration
O(n)
Understanding Time Complexity

We want to understand how the time it takes to handle CORS settings in nginx changes as more requests come in.

Specifically, how does nginx process CORS headers for each request?

Scenario Under Consideration

Analyze the time complexity of the following nginx CORS configuration snippet.


    location /api/ {
      if ($http_origin) {
        add_header Access-Control-Allow-Origin "$http_origin";
        add_header Access-Control-Allow-Credentials "true";
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
        add_header Access-Control-Allow-Headers "Authorization,Content-Type";
      }
      if ($request_method = 'OPTIONS') {
        return 204;
      }
      proxy_pass http://backend;
    }

This code sets CORS headers for requests to /api/ and handles preflight OPTIONS requests.

Identify Repeating Operations

Identify the loops, recursion, array traversals that repeat.

  • Primary operation: nginx processes each incoming HTTP request and applies the CORS header rules.
  • How many times: Once per request; no loops or recursion inside the configuration.
How Execution Grows With Input

Each request triggers the same fixed set of header additions and checks.

Input Size (n)Approx. Operations
1010 sets of header checks and additions
100100 sets of header checks and additions
10001000 sets of header checks and additions

Pattern observation: The work grows linearly with the number of requests, but each request's processing time stays constant.

Final Time Complexity

Time Complexity: O(n)

This means the total work grows directly with the number of requests, but each request is handled in constant time.

Common Mistake

[X] Wrong: "Adding more CORS headers makes each request take longer in a way that grows with the number of headers."

[OK] Correct: The number of headers is fixed and small, so each request still takes about the same time regardless of header count.

Interview Connect

Understanding how nginx handles CORS per request helps you explain server behavior clearly and shows you can reason about request handling efficiency.

Self-Check

"What if we added a loop inside nginx config to check multiple origins dynamically? How would the time complexity change?"

Practice

(1/5)
1. What is the main purpose of configuring CORS in an nginx server?
easy
A. To control which websites can access server resources
B. To improve server performance by caching
C. To encrypt data between client and server
D. To block all incoming traffic

Solution

  1. Step 1: Understand CORS purpose

    CORS (Cross-Origin Resource Sharing) controls which external websites can request resources from your server.

  2. Step 2: Identify correct purpose in options

    Only To control which websites can access server resources describes controlling access from other websites, which matches CORS functionality.

  3. Final Answer:

    To control which websites can access server resources -> Option A

  4. Quick Check:

    CORS controls access = D [OK]
Hint: Remember CORS controls cross-site resource sharing [OK]
Common Mistakes:
  • Confusing CORS with encryption or caching
  • Thinking CORS blocks all traffic
  • Assuming CORS improves performance
2. Which of the following is the correct syntax to add a CORS header allowing all origins in an nginx configuration?
easy
A. add_header "Access-Control-Allow-Origin" "*";
B. add_header "Access-Control-Allow-Origin" *;
C. add_header Access-Control-Allow-Origin "*";
D. add_header Access-Control-Allow-Origin *;

Solution

  1. Step 1: Understand nginx add_header syntax

    The header name does not require quotes unless it contains spaces or special characters. The value must be quoted if it is a string like "*".

  2. Step 2: Identify correct quoting

    add_header Access-Control-Allow-Origin "*"; correctly quotes the value and does not quote the header name, which is the recommended syntax.

  3. Final Answer:

    add_header Access-Control-Allow-Origin "*"; -> Option C

  4. Quick Check:

    Proper quoting for header value only = B [OK]
Hint: Quote header value for safety in nginx, header name usually unquoted [OK]
Common Mistakes:
  • Quoting header name unnecessarily
  • Using * without quotes
  • Misplacing semicolons
3. Given this nginx snippet inside a location block: 
if ($request_method = 'OPTIONS') {
  add_header Access-Control-Allow-Origin "*";
  add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
  add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range";
  add_header Access-Control-Max-Age 1728000;
  add_header Content-Type "text/plain charset=UTF-8";
  add_header Content-Length 0;
  return 204;
}
What will be the HTTP status code returned for an OPTIONS request?
medium
A. 200
B. 204
C. 400
D. 500

Solution

  1. Step 1: Analyze the if block for OPTIONS method

    The configuration checks if the request method is OPTIONS, then sets headers and returns status code 204.

  2. Step 2: Identify the return status code

    The line return 204; explicitly sends HTTP status 204 (No Content) for OPTIONS requests.

  3. Final Answer:

    204 -> Option B

  4. Quick Check:

    OPTIONS returns 204 No Content = B [OK]
Hint: Look for return statement inside OPTIONS check [OK]
Common Mistakes:
  • Assuming default 200 OK instead of 204
  • Confusing OPTIONS with GET method
  • Ignoring explicit return codes
4. You added this to your nginx config to allow CORS: 
add_header Access-Control-Allow-Origin *;
But browsers still block cross-origin requests. What is the likely problem?
medium
A. The add_header directive is inside a location block without 'always' parameter
B. The header is missing quotes around '*', causing syntax error
C. nginx does not support CORS headers
D. You need to restart the browser to apply changes

Solution

  1. Step 1: Understand add_header behavior in nginx

    By default, add_header only adds headers on successful (2xx) responses. For OPTIONS or error responses, headers may be missing unless 'always' is used.

  2. Step 2: Identify missing 'always' parameter

    Without 'always', CORS headers may not be sent on OPTIONS or error responses, causing browser blocks.

  3. Final Answer:

    The add_header directive is inside a location block without 'always' parameter -> Option A

  4. Quick Check:

    Missing 'always' causes headers to be skipped = A [OK]
Hint: Use 'always' with add_header to send headers on all responses [OK]
Common Mistakes:
  • Not using 'always' with add_header
  • Assuming nginx lacks CORS support
  • Forgetting to reload nginx after config changes
5. You want to configure nginx to allow CORS only from https://example.com and support preflight OPTIONS requests. Which configuration snippet correctly achieves this?
hard
A. add_header "Access-Control-Allow-Origin" "*"; add_header "Access-Control-Allow-Methods" "GET, POST"; return 204;
B. add_header Access-Control-Allow-Origin *; if ($request_method = 'OPTIONS') { return 200; }
C. add_header "Access-Control-Allow-Origin" "https://example.com"; add_header "Access-Control-Allow-Methods" "GET, POST, OPTIONS"; add_header "Access-Control-Allow-Headers" "Content-Type"; return 200;
D. add_header "Access-Control-Allow-Origin" "https://example.com" always; if ($request_method = 'OPTIONS') { add_header "Access-Control-Allow-Methods" "GET, POST, OPTIONS" always; add_header "Access-Control-Allow-Headers" "Content-Type" always; add_header "Access-Control-Max-Age" 1728000 always; return 204; }

Solution

  1. Step 1: Check origin restriction

    Only add_header "Access-Control-Allow-Origin" "https://example.com" always; if ($request_method = 'OPTIONS') { add_header "Access-Control-Allow-Methods" "GET, POST, OPTIONS" always; add_header "Access-Control-Allow-Headers" "Content-Type" always; add_header "Access-Control-Max-Age" 1728000 always; return 204; } restricts origin to "https://example.com" correctly with proper quoting and 'always' parameter.

  2. Step 2: Verify OPTIONS preflight handling

    The configuration handles OPTIONS requests by returning 204 with required CORS headers and 'always' to ensure headers are sent.

  3. Step 3: Eliminate incorrect options

    Snippets using '*' allow all origins instead of restricting to https://example.com; those lacking full OPTIONS handling, 'always' parameter, or returning 200 instead of 204 fail preflight checks.

  4. Final Answer:

    Correctly restricts origin and handles OPTIONS with headers and 204 -> Option D

  5. Quick Check:

    Restrict origin + OPTIONS 204 + always = C [OK]
Hint: Use 'always' and return 204 for OPTIONS with restricted origin [OK]
Common Mistakes:
  • Using wildcard '*' instead of specific origin
  • Not handling OPTIONS preflight properly
  • Missing 'always' causing headers to be skipped
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard