CORS configuration in Nginx - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does CORS stand for and why is it important?

CORS stands for Cross-Origin Resource Sharing. It allows a web page from one domain to request resources from another domain safely, preventing security risks.

beginner

Which HTTP header is used to allow cross-origin requests in nginx?

The header Access-Control-Allow-Origin is used to specify which domains can access resources from the server.

beginner

How do you enable CORS for all domains in nginx?

Add the line add_header Access-Control-Allow-Origin "*"; inside the server or location block to allow all domains.

intermediate

What is the purpose of the Access-Control-Allow-Methods header?

It specifies which HTTP methods (GET, POST, etc.) are allowed when accessing the resource from another origin.

intermediate

Why might you need to add Access-Control-Allow-Headers in your nginx CORS setup?

This header tells the browser which custom headers can be sent with the request, enabling more complex requests like those with authentication tokens.

Which nginx directive adds a header to enable CORS?

A add_header

B set_header

C proxy_pass

D listen

The add_header directive is used in nginx to add HTTP headers like those needed for CORS.

What value allows all domains to access your resource via CORS?

A "all"

B "*"

C "none"

D "localhost"

Using "*" in Access-Control-Allow-Origin allows any domain to access the resource.

Which header controls which HTTP methods are allowed in CORS?

A Access-Control-Allow-Methods

B Access-Control-Allow-Origin

C Access-Control-Allow-Headers

D Access-Control-Expose-Headers

Access-Control-Allow-Methods specifies allowed HTTP methods like GET, POST, PUT.

If you want to allow credentials (cookies) in CORS, which header must NOT be set to "*"?

A Access-Control-Max-Age

B Access-Control-Allow-Methods

C Access-Control-Allow-Headers

D Access-Control-Allow-Origin

When allowing credentials, Access-Control-Allow-Origin must specify an explicit domain, not "*".

Where in nginx config do you usually place CORS headers?

A Only in events block

B Inside http block only

C Inside server or location block

D In upstream block

CORS headers are typically added inside server or location blocks to control specific resources.

Explain how to configure nginx to allow cross-origin requests from a specific domain.

Think about which header controls allowed origins.

Describe why CORS is necessary and what problem it solves in web browsers.

Consider how browsers protect users from unsafe data sharing.